In my UI, users are able to build some javascript objects like:
var box = {
"width": "100px",
"height": "200px",
"click": function () {
alert("You clicked the box");
}
};
This is a valid javascript object. Now, i want a way to validate this in php. I can use json_encode/json_decode but it will not work do the the "function() ..." thing. Do you have any suggestion?
For a quick, dirty, and unsafe solution, you could have node installed on the server, and call PHP's exec() to validate the code.
From the documentation, exec is defined as:
string exec ( string $command [, array &$output [, int &$return_var ]] )
and with node, we can evaluate a JavaScript string by using the -e flag. Example using the command line:
> node -e 'invalid javascript'
SyntaxError: Unexpected identifier
> $?
-bash: 8: command not found # <-- return status!
Tying it together with PHP's exec, you could have something like this:
<? php
$userJavaScript = getUserJavaScriptSomehow();
exec("node -e '" + $userJavaScript + "'", $output, $return_var);
if ($return_var !== 0) {
// something went wrong with parsing it.
}
?>
Note that this is a horrible solution. You're better off validating the JavaScript on the client side and forget doing validation on the server side all together considering the user can execute any arbitrary code. You would have to safeguard against file access, infinite loops, etc.
I suppose you try to validate an object built from user input. Since writing a complete JavaScript parser in PHP would be difficult, I suggest the following approach: After all data was entered, request the JavaScript object from the PHP script via Ajax. Then you can do an eval on the client side to see if there are any errors.
A more general advice: Don't mix executable code and data! Just exchange easily validatable JSON objects between client and server and write some static JavaScript code that processes the JSON objects. This will also protect you better against code injections from user input.
PHP could only validate the JSON part of the code. If you want a server side technology use nodejs for that. Simple run the code via node code.js and see if there are any errors. So, I guess that you should get the code, save it to a file and run node against it.
json_decodeis used to handle data in JSON representation, and your javascript objectboxis not. Either exclude attributeclick, or parsing the javascript code with UglifyJS.php which I got from this question