Skip to main content
Post Made Community Wiki by animusonStaffMod
added 54 characters in body
Source Link
bfavaretto
  • 72.1k
  • 16
  • 14

I suppose global eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
new Function("alert('function constructor not blocked')")();

Or maybe not. It's global to the sandbox after all.

I suppose global eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
new Function("alert('function constructor not blocked')")();

I suppose global eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
new Function("alert('function constructor not blocked')")();

Or maybe not. It's global to the sandbox after all.

added 49 characters in body
Source Link
bfavaretto
  • 72.1k
  • 16
  • 14

I suppose global eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
 
new Function("alert('function constructor not blocked')")();

I suppose eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
 
new Function("alert('function constructor not blocked')")();

I suppose global eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");
new Function("alert('function constructor not blocked')")();

Source Link
bfavaretto
  • 72.1k
  • 16
  • 14

I suppose eval should be blocked?

(0,eval)("alert('indirect eval call not blocked')");

new Function("alert('function constructor not blocked')")();