如果此JavaScript代码在服务器（nodeJS）上运行，其安全性或安全性如何？

Question

Curious as to what unforeseen issues this type of code might present, if executed on the server. Or if there are any non eval alternatives.

var a = {b:1, c:2, d:3, e:[1,2,3]};
(function(path) { return eval('this'+path) }).call(a, '.e[2]');

Answer 1

Given that path is a static value ( ".e[2]" ) and a does not have any malicious accessors or so, there is nothing insecure here except that it's totally unnecessary.

However, if path does come from a client or some other untrusted source, then passing it to eval is the worst thing you can do. It can do everything that JS code can do in node - and that is enough to harm you severely.

And yes, there are tons of non-eval alternatives .