8

Some times ago, I decided to post a question that I had in my mind for a long time.
It was about the evilness of Eval in C#.

There are several posts from Microsoft MVP and C# developers on the subject.
You can learn how it works. Learn about the late binding. The compiler call. All those posts are basically about performance, debugging.

But, in my mind Eval comes with a security hole. There are several casual allusions to the security issue. I just fail to find real documentation about this point.

So I felt like Stack Overflow was a good place to ask about it.

With no harm intended, not trying to hack or anything, the question was simple:
What can an eval on a db stored string can do that a more classical databind won't?
So everything that could be harmful with a simple databind was outside the scope of the question.

It was not really asking for any proof of concept for a server wipe exploit. It was more about the current restriction C# eval has or doesn't have.
The list of exploits that could be done even without proof was shown.

But I have made mistakes:

Even if I try to make my post clear and show my non-harmful intentions. My broken English and low rep may fool people into thinking I was a weird hacker. As they often fail to hide their intentions.

My early research on the topic was too light. I just quickly read the top 10 Google results on the subject.
And assumed that my question was legitimate and not fully answered by those posts.

Perhaps the Eval subject was an unspoken taboo, and asking about it made people direct their hate against this thing against the post.

The post could possibly be more on-topic on Security Stack Exchange.

With all those mistakes, I quickly reached the score of -10 on this question. Resulting in a question close. And a ban from asking.

I understand the ban as I mainly ask and post about . And the low amount of visits in that tag doesn't bring many upvotes/downvotes.
With a low ratio of quality posts on the subject.

Expecting a meta effect, the only thing I would ask is how could I make this question "ok" for the community? Or how to stop the bleeding?

The question is about what could go wrong. Not about how to prevent it. It's not about how to fix Eval. It should be an advocacy on why not to use it based on the security aspect.

16
  • 4
    Maybe you could give the link to the question ?
    – Tensibai
    Jan 13, 2017 at 13:49
  • 3
    Side note: one highly downvoted post should not trigger a ban - there's likely some deleted ones. (I don't see why it was necessary to vote down that post to -10 - perhaps someone with insight in the tag can explain.)
    – Pekka
    Jan 13, 2017 at 13:50
  • 1
    Sure but in order to keep the title don't down vote to much. stackoverflow.com/questions/41143685/eval-injection Jan 13, 2017 at 13:52
  • Well, you're asking why a question did get such a negative score, I did found it anyway, giving a link can just ease the access. If you really care, post a screenshot here instead.
    – Tensibai
    Jan 13, 2017 at 13:54
  • Not why! I'm pretty sure I already listed the reason it has been downvoted. Jan 13, 2017 at 13:57
  • The question before extensive edits was very short without much detail. I don't think it is worth -10 now but maybe was when posted.
    – Turnip
    Jan 13, 2017 at 13:57
  • 1rst version of the question is bad! It reach -3 and get an answer. The answer feel a little bit "contradictoire". Jan 13, 2017 at 13:59
  • I don't think it is on-topic on Security Stack Exchange; they'll probably feel it belongs on SO. Saying "I have no evil intentions" never works - evil people would say the same. Jan 13, 2017 at 13:59
  • then edit war against downvote begin it hit -5 in the last version in manage to get to -10 Jan 13, 2017 at 13:59
  • If there was evil intention, why would a 30k user post an answer saying its no harm ! Jan 13, 2017 at 14:02
  • 7
    Rep means nothing. I have 21k+ and I don't know what I'm talking about.
    – Turnip
    Jan 13, 2017 at 14:04
  • 1
    Just to be clear on this: I believe you did not intend harm. Besides, we generally assume that if something is harmful, we should publicize it. The good guys also need to know, so they can build their defenses. It's just that saying "I have no evil intentions" doesn't convince anyone. Jan 13, 2017 at 14:05
  • The Idea are in the order of trust i have in them. Being on Security Exchange is last on the list. Just after Eval Witch Hunter. Jan 13, 2017 at 14:06
  • All the mess in my question camed from my urge to fix it and to show that commenting "don't use eval" was not revelant. Jan 13, 2017 at 14:13
  • Pierre, to get an idea of when those downvotes happened – before or after a specific edit, for example – you can look at a precise timeline of events.
    – Jongware
    Jan 13, 2017 at 15:31

2 Answers 2

7

Let's screenshot part of your question to answer based on it:

Just the question screenshoted, a bunch of titles in bold, some English mistakes and a highlight by me on the question part

So for the "Question" part, it's quite unclear, remove the code inserts and it's down to: "Is it possible to make an eval do anything that you would not expect to do, and how?" It doesn't really make sense, and using bold text interleaved with code examples without explanation makes it even harder to read.

One way to rephrase your question could be:


I found documentation speaking about "Eval is evil", I understood it has performances issues, and even MSDN states it:

Because this method performs late-bound evaluation, using reflection at run time, it can cause performance to noticeably slow compared to standard ASP.NET data-binding syntax - MSDN

Out of the performance issue and considering the following code:

<%# Eval("MyDataFieldFromDataBase") %>

Can something be done to prevent the field to be interpreted in a dangerous way?


This could a shorter form, removing fluff around, showing you did some research and it becomes a relatively clear question, not invalidating the answer at the same time.

After last edit to question:

The question is about what could go wrong. Not about how to prevent it. It's not about how to fix Eval. It should be an advocacy on why not to use it based on the security aspect.

For the sentence I put in bold: then you're out of luck, we're here to build factual knowledge base, not to support your claims, specially when there's no evidence to support them.
You did claim something and want community backup? Great, now accept you were wrong and apologize to your colleagues as it turns out the reality is not your original claim.

If your question was really this you may have asked instead of the version above (keeping the search part to back it up):

Should I also avoid using Eval for security concerns? And if yes which kind of exploits should I prevent against if I really have to use it?

16
  • "Whatever is well conceived is clearly said, And the words to say it flow with ease." Thanks a lot bringing my question to this! Jan 13, 2017 at 14:10
  • 1
    I hope the example will help you trim down to the necessary only for the future, Showing research effort you did, giving a minimal case and staying right to the point of your question. Even if you have a misunderstanding that's ok, someone will be happily OK to explain it as you exhibited you tried to understand by yourself first.
    – Tensibai
    Jan 13, 2017 at 14:14
  • But the point is that I know how to prevent dangerous interpretation. Not using Eval is the best way! and saying "Can something be done to the field to be interpreted in a dangerous way ?" Sound like help me break it. Jan 13, 2017 at 14:15
  • @PierreLebon Asking about how to prevent injection when asking about a function means using this function. No need to ask if you don't use it. As I asked above, if there's nothing to do someone will answer this way, if there's something to do, someone will answer explaining why it is necessary to prevent injection when using it OR somone will answer explaining why the only way to prevent injection is to not use this function. All are possible, the best answer will confirm your idea or infirm it. (which seems to be the case, the evil is for perf, not for security).
    – Tensibai
    Jan 13, 2017 at 14:19
  • 2
    @PierreLebon my point being: don't ask waiting an answer to back up your position. Ask your question, if the answer goes your way but isn't enough you can express your not covered concerns in comments, author may add some more information to clear them up. If the answer just invalidate your position, live with it and review your position or argumentation.
    – Tensibai
    Jan 13, 2017 at 14:22
  • Ok I get it now. Ask how and people will tell you why. I will copy past your version and hope for the best. Thanks for your time. Jan 13, 2017 at 14:26
  • There are evidence Ms Mvp said in a comment, I will look for, "Eval injection are worst that any other injection." or something like this. And I knew he wont say how to or why on a MSDN blog post. Jan 13, 2017 at 14:29
  • Added another version expressing your concern specifically. but I'm pretty sure the first version would be the better way to approach it on stack overflow.
    – Tensibai
    Jan 13, 2017 at 14:30
  • Last version of the question sound perfect. Thanks again for your time! We spend to mutch time on this post already. I will copy past your version. Here is my green tick to show my gratitude. Jan 13, 2017 at 14:31
  • I 'am taking the 1rst version of the question as i trust your expertise. As I already show that I just can't ask nice question. Jan 13, 2017 at 14:33
  • Good answer, except for the spaces before the question marks :P. Jan 13, 2017 at 16:38
  • @MikeMcCaughan Feel free to edit if there's things to improve ;) (But I'll try to keep it my mind for next time)
    – Tensibai
    Jan 13, 2017 at 16:54
  • @Mike I checked again, I did use my language rule. Space around the question mark in French. I'll remember the difference next time
    – Tensibai
    Jan 13, 2017 at 22:21
  • @Peter thanks for the fix on typos :)
    – Tensibai
    Jan 13, 2017 at 22:27
  • 1
    @Mike no problem, I was curious about bout why I used a 'wrong' typography, I did learn we have a special CA sa e in French, that's always great to learn something new ;)
    – Tensibai
    Jan 13, 2017 at 22:35
5

The question looks like applying a concept from one language to a completely different one, making it very confusing. "eval is evil" is traditionally a JavaScript expression. While it sounds like a good phrase to use for all other languages it very well could indicate complete misunderstanding of the concept.

While there are articles (like https://www.codeproject.com/articles/623516/the-evil-of-eval-in-asp-net) trying to promote the same "eval is evil" for other frameworks/languages its original and most common usage is for JavaScript.

The question would be much better if instead of

"Eval is evil" is a well known phrase.

you would actually demonstrate that you understand origins of the phrase and that you actually talking about the right one.

I've heard "Eval is evil" in context of JavaScript and seen plenty of discussion in (like When is JavaScript's eval() not evil?). I run into The Evil of Eval in ASP.NET article - so presumably ASP.NET Eval it is evil (covers performance cost similar to MSDN article). Are there additional problems (like code injection of some sort) with ASP.NET Eval similar to the JavaScript one?

1
  • In R it's eval(parse(...)) is evil and should be avoided at all costs :)
    – Tensibai
    Jan 13, 2017 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .