Javascript Eval and Function constructor usage

Question

I'm currently experimenting on self replicating code. Out of love for the language I'd like to write it in javascript.

I'm working on a program that writes a function's code which in turn writes its function own code and so on. Basically, the desired process is this:

I manually create A function which returns code (which includes some randomness) and a numeric value (proposed solution to a problem).
I call this function a number of times, evaluate the results of each of those returned functions, and continue the process until I have code that is sufficiently good for what I'm trying to do.

Now, I have always been told how eval is evil, how never to use it and so on. However for my specific use case it seems like the Function constructor or eval are exactly what I'm looking for.

So, in short the question is:

Are eval/Function constructor indeed the best tools to use in my case? If so, I figured I'd use the Function constructor to scope the code executed, but is there a way to truly limit it from accessing the global scope? Also, what are some good practices for eval usage in my case?

Note: I did not label it with genetic programming since the question is strictly regarding the language specific practices for using eval/Function ctor, — Benjamin Gruenbaum
– Benjamin Gruenbaum, Commented Dec 15, 2012 at 13:53
For doing what you describe, eval() and the Function() constructor are your only tools anyway. They're only evil when used needlessly or incorrectly. — Pointy
– Pointy, Commented Dec 15, 2012 at 13:54
What about a controlled environment? I know I can integrate javascript into another language and use it for scripting inside the language, Is there a way to scope a javascript VM inside a javascript VM in order to prevent scope breach? (I'm not using a browser) — Benjamin Gruenbaum
– Benjamin Gruenbaum, Commented Dec 15, 2012 at 13:56
Well you could use Rhino from Java, but that's sort-of a pain. If you're doing what amounts to a research project, I don't see why it's important to protect the global scope, and it's probably just not possible anyway. — Pointy
– Pointy, Commented Dec 15, 2012 at 14:06

Benjamin Gruenbaum · Accepted Answer · 2013-06-10 00:08:47Z

1

I think I just figured out something I could use:

If I run my javascript code using node.js I can use the vm module which allows me to execute javascript code safely in a new context, and without letting the executed code have any access to the local or global scopes.

vm.runInNewContext compiles code, then runs it in sandbox and returns the result. Running code does not have access to local scope. The object sandbox will be used as the global object for code. sandbox and filename are optional, filename is only used in stack traces.

You can see a full example here: vm.runInNewContext

This will allow me to eval code safely, and seems to be the safest way (I found) currently available. I think this is a much better solution than eval or calling the Function constructor.

Thank you everyone who helped.

edited Jun 10, 2013 at 0:08

answered Dec 15, 2012 at 14:10

Benjamin Gruenbaum

278k90 gold badges524 silver badges524 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ThiefMaster Over a year ago

Yes, that's much better than eval in case you do want it in a new context and use nodejs.

Benjamin Gruenbaum Over a year ago

Thanks, if you have any other suggestions I would love to hear them. nodejs seems like a good choice for a javascript environment anyway.

ThiefMaster Over a year ago

Yes, it's pretty much the only good choice if you don't need a browser and don't want it inside a JVM (where Rhino might be the preferred choice)

Woody · Accepted Answer · 2012-12-15 14:04:11Z

0

Unfortunately I believe there is no way to prevent it from accessing the global scope. Suppose for example that in a web browser i evaled some code like this :

(function(window) {
   eval(script);
)(null));

Any time the script tries to access window - it will get an error, since window is null. However someone who knew what they were doing could always do this :

var global = (function() {
    return this;
}());

Since when you invoke a function in what Crockford calls the "function invocation style" then the this is always bound to the global variable.

answered Dec 15, 2012 at 14:04

Woody

8,0822 gold badges23 silver badges25 bronze badges

1 Comment

Pointy Over a year ago

You don't even need an explicit reference to the global scope to access global variables.

Collectives™ on Stack Overflow

Javascript Eval and Function constructor usage

2 Answers 2

3 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related