javascript evaluate simple user submitted math node.js

Question

I need to evaluate some simple user submitted math. Multiplication of 2 numbers for example.

This opens me up to injection attacks.

My plan is to whitelist a bunch of values [^|(|)|\d+|\*|\/|\+|-] and replace everything else with regex before evaluation.

Any problems with this?

Example strings:

324*32
(5+4-17) / 3

Please, add samples of strings to check. As I assume, strings like '54*4' or '5 - 7' must pass the regular expression test? — Phillip Kovalev
– Phillip Kovalev, Commented May 18, 2011 at 16:00
Not really an answer to your question, but your character class is wrong — you don't need the pipes, ^ at the beginning negates it, and you can't use repetition operators in a character class. Use [()^\d*/+-] instead. — Ben Blank
– Ben Blank, Commented May 19, 2011 at 5:47
If you add [, ] and ! to that set, we can start to do some damage! ([][1]+[])[2]+(![]+[])[4]+([][1]+[])[1]+([][1]+[])[5]+(![]+[])[4]+([][1]+[])[2] === 'denied' — user578895
– user578895, Commented May 19, 2011 at 6:17

Tikhon Jelvis · Accepted Answer · 2011-05-19 06:00:24Z

1

I can't think of any particularly nasty way to mess up your server too much using just numbers and a handful of operators, however, there are some things you need to look out for:

Given that the [^...] is a character class, you do not need to separate every value with |. This is probably what you really want: [^^()\d*\/+-]. This will match everything you do not want to allow.

Additionally, it is important to remember that, in JavaScript, ^ does not represent powers but rather "exclusive or". This means, for example, that 2 ^ 3 == 1. So you probably do not want to whitelist ^: [^()\d*\/+-].

You might encounter invalid syntax like (1 * (2 + 3), so you should watch out for that as well. You can probably just have a try catch block and meaningfully deal with things like that (report the problem back to the user or something).

answered May 19, 2011 at 6:00

Tikhon Jelvis

68.3k19 gold badges183 silver badges217 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

javascript evaluate simple user submitted math node.js

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related