Validate that a string is valid JavaScript

Question

I am creating a website that will demonstrate the dangers of XSS. Users will attempt to get JavaScript to execute using an XSS vulnerability.

However, I am running into problems in determining if JavaScript is actually being executed so that I can record that the user was successful. I will be running these checks on a node.js server.

I originally planned to run eval on the parts which would contain JavaScript if the user was successful, but thought that this would be too dangerous as it would be running on the server-side and could get the server exploited.

Are there any ways to using JavaScript to validate if a string is valid JavaScript other than running eval? Or is there a way to run eval without putting my server at risk?

go-oleg · Accepted Answer · 2014-03-23 17:50:02Z

5

You could use the esprima javascript parser to see if the string is valid javascript syntax.

Install using npm install esprima.

To use:

var esprima = require('esprima');

var userStringToTest = 'var a = 10;';

var isValid = isValidJs(userStringToTest);

if(isValid) {
  console.log('its valid!');
}
else {
  console.log('its NOT valid!');
}

function isValidJs(testString) {
  var isValid = true;
  try {
    esprima.parse(testString);
  }
  catch(e) {
    isValid = false;
  }
  return isValid;
}

As @FelixKing pointed out in his comment, this of course won't detect runtime errors. For your use case though, it sounds like you should be testing for syntax errors as opposed to runtime errors since that is both more strict and there really shouldn't be valid javascript syntax to begin with.

edited Mar 23, 2014 at 17:50

answered Mar 23, 2014 at 17:20

go-oleg

19.5k3 gold badges46 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Felix Kling Over a year ago

Of course this will only detect syntax errors, not runtime errors. Depends on what the OP means by "valid JavaScript" I guess.

Brad · Accepted Answer · 2014-03-23 17:11:21Z

1

What you need is a JavaScript sandbox, which will isolate their code from the code running it.

There are several to choose from. I've used "Sandbox" before: http://gf3.github.io/sandbox/

Execute their code in the sandbox, see if there were errors, return the output.

answered Mar 23, 2014 at 17:11

Brad

164k57 gold badges380 silver badges559 bronze badges

Comments

MasterScrat · Accepted Answer · 2014-03-23 17:14:38Z

0

Google Caja would be a good solution for this.

The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your website.

There are multiple wrappers that will let you run it on a node server, such as this one: https://github.com/theSmaw/Caja-HTML-Sanitizer

answered Mar 23, 2014 at 17:14

MasterScrat

7,41615 gold badges52 silver badges80 bronze badges

Collectives™ on Stack Overflow

Validate that a string is valid JavaScript

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related