is there a more secure eval-like function in javascript that cannot resolve variables?

Question

I mean function that is only able to do logical and mathematical operations, for example: 3+5<=9, "string"=="string" && (3<9 || 12>3), but not like this a+b<c, "string".length > 3 or calling functions, so the programmer must resolve (by regex or otherwise) all the possible names before it is evaluated ?

edit:

So I found one good reason to use eval() ...

You can make a parser yourself.. there are many tutorials on the web — Esailija, Aug 09 '12 at 13:21
possible duplicate of [Equation (expression) parser with precedence?](http://stackoverflow.com/questions/28256/equation-expression-parser-with-precedence) — jbabey, Aug 09 '12 at 13:23
possible duplicate of [Javascript math parser library](http://stackoverflow.com/questions/3936730/javascript-math-parser-library) — Andras Zoltan, Aug 09 '12 at 13:24
@Esailija: yes but isn't it reinventing the wheel ? As I think of it the eval function should have a few options to restrict what code inside can do. Or maybe another written for scratch meant for such simple cases, much faster (when run by js engine and not my crappy code) well pity — rsk82, Aug 09 '12 at 13:24
I didn't read your motives well then, of course you can use an already made library as well. But then you won't learn anything (Since this task is usually done for learning) — Esailija, Aug 09 '12 at 13:26
@jbabey: can this tool do this thing: `"string"=="string" && (3<9 || 12>3)` ? But of course I do not have in mind things like `"string".length > 3`. — rsk82, Aug 09 '12 at 13:30
@AndrasZoltan: my example is not for match only but for direct string comparisons and logical operations too. — rsk82, Aug 09 '12 at 13:36
@rsk82, of course that's reinventing. Though your wheel is some math parser library, not JavaScript compiler, which is immensely more powerful and heavy thing. — Oleg V. Volkov, Aug 09 '12 at 13:37

score 2 · Answer 1 · answered Aug 09 '12 at 14:06

Tbh I think the simplest answer to your question is 'no there isn't'.

You can write one yourself, find an existing one (which will be a JS library) - or get a parser generator to generate you a parser that can run on Javascript.

ANTLR is one such tool/platform - you'll find the Javascript runtime download on the downloads page. You will need the ANTLRWorks tool in order to get to grips with it, however, and produce a gammar that actually works.

It's possible to get a rudimentary Math parser (supporting the four main operators) up and running in a few minutes once you know what you're doing.

score 0 · Accepted Answer · edited May 23 '17 at 12:12

0

Yes, there is a solution: just create a new function object, it has advantage that it does not pollute scope... well it looks definitely safer: https://stackoverflow.com/a/7650148/393087

Yes, I know , this is not what I really wanted but is closer in right direction in terms of safety.

edited May 23 '17 at 12:12

Community

1
1

answered Sep 17 '12 at 20:46

rsk82

28,217
50
150
240

is there a more secure eval-like function in javascript that cannot resolve variables?

2 Answers2