JavaScript - Get result of last expression for code snippet

Question

I am working on a developer tool that should evaluate user code the same way the console does. For example, if I type multiple expression into the console, like this:

var x = 0; x++; x;

I immediately get the result of the last expression (1).

The obvious solution to replicate this behavior in my web app would be to execute the user code with eval, like this:

let result = eval('var x = 0; x++; x;');

However, eval has obvious performance implications and security concerns, so I want to avoid it. My solution right now is to inject a script in a sandboxed environment (iframe). I feel like this is better than eval, but it does not solve the main issues which are:

1. Modifying the user code in such a way that it can be written to a variable
2. Getting the result of the last expression, regardless of what the user inputs (could be any code, just like one would do in the console)

Also, I would like to avoid using libraries (for example to parse and execute the code) for such a simple task. If anyone has some ideas or suggestions it would be greatly appreciated.

Answer 1

Instead of eval I use new Function(). That allows me to wrap my code into a function scope and avoid the evaluated code to break/mutate my own code. In your case I see at the moment a few ways to go further:

---

• Wrap your eval into a function:

let result = new Function('', 'return eval("var x = 0; x++; x;")');
console.log(result());

So if a user tries to change some outer scopes' variables he will get an error:

try{
  let result = new Function('', 'return eval("var x = 0; x++; y++; x;")');
  console.log(result());
}catch(e){
  console.error(e.message);
}

---

• Wrap a user's code into a function and return the last expression:

let result = new Function('', 'var x = 0; x++; return x;'); 
console.log(result());

The problem is here that at a glance you need a JS parser here. At least one that splits JS code into statements. Probably could be done by oneself, but I didn't try to write such one. So maybe some 3rd party dependence is needed here at the end.

---

• Redeclare window's members:

Also we have some general security problems like access to window. We can override the window's members and itself in the function. This options looks the most promising among the previous ones:

const globals = Object.keys(window);
const overrides = 'let ' + globals.map(name => name + ' = null').join(',') + ';'

const userCode = 'alert("SPAM")';

try{
  let result = new Function('', overrides + `return eval(${userCode})`); 
  console.log(result());
}catch(e){
  console.error(e.message);
}