How to get a JavaScript variable?

Question

From a page containing (or referring to) my JavaScript I do an AJAX XHR request to an external Web site.

The external Web site return on our GET request a JavaScript file like this:

var __xxx = {
    // ....
};

How do I get the value of the variable __xxx in my JavaScript?

Currently, the only way I invented is to remove var __xxx using a regular expression and parse the remaining using a JSON parser. Is there a better way?

The external Web site may be considered as trusted if necessary, but I would prefer not to trust the data from it (using some safe parser like JSON).

You could create a <script> tag on you page and insert the JS code into it — Sebastian Speitel
– Sebastian Speitel, Commented Aug 14, 2018 at 18:52
@SebastianSpeitel I need to retrieve this value not once on page loading, but (probably several times) on keyboard events. Should I remove a <script> and re-create it for every event? — porton
– porton, Commented Aug 14, 2018 at 18:53
not much you can do if that is the format could eval it or new Function, but than that is security risks. — epascarello
– epascarello, Commented Aug 14, 2018 at 18:54

zfrisch · Accepted Answer · 2018-08-14 19:00:32Z

1

Create a new function utilizing strings and the Function constructor. Add 'return _xxx;' and assign the result to a new variable that is accessible in your current script.

var returned_data = new Function(data + " return _xxx;")()

This is preferable to eval because the execution of the function will not allow access to local variables outside of the function scope.

edited Aug 14, 2018 at 19:00

answered Aug 14, 2018 at 18:58

zfrisch

8,6901 gold badge26 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

epascarello Over a year ago

And this will execute any other random code so it is not really the best solution.

zfrisch Over a year ago

@epascarello as opposed to what? This is a bit of a ridiculous scenario. It's never going to be good when you're working with external scripts that you can't touch and aren't sure you trust. In that vein this is probably the safest way, though obviously It's still not advisable.

epascarello Over a year ago

Like the OP said.... strip off the leading variable declaration and run it through the JSON.parse which is more secure.

zfrisch Over a year ago

@epascarello That requires, still, that you know explicitly what's in the returned script or it won't run, and if that's the case, then this solution is just as pragmatic.

epascarello Over a year ago

But if someone slips in window.open(), alert, window.location.href, etc into the code, it will not run it if you match the pattern.... If you trust it, sure go ahead, but if there is any way the data could change on you, is it worth the risk?

|

rickjerrity · Accepted Answer · 2018-08-14 18:54:43Z

1

I believe your best options are to either do what you are currently doing (parse the string Javascript and JSON.parse it) or to use the eval method on the incoming Javascript string.

I would personally recommend parsing the string, but it depends on the Javascript you're returning from this endpoint. Eval would almost certainly work in either case, but can be dangerous

answered Aug 14, 2018 at 18:54

rickjerrity

8141 gold badge9 silver badges15 bronze badges

Collectives™ on Stack Overflow

How to get a JavaScript variable?

2 Answers 2

6 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related