如何不使用eval调用存储在字符串中的胖箭头函数？

Question

How do you call fat arrow function like below (stored in string) without using eval?

"g => { alert(g); }"

With using eval, the below code is working fine, but I want to avoid using eval.

eval("g => { alert(g); }")('hello')

I hope I could do something like below using "new Function", but I have no luck so far.

new Function("g => { alert(g); }")('hello')

Thanks so much in advance.

Answer 1

from MDN

The Function constructor creates a new Function object. Calling the constructor directly can create functions dynamically, but suffers from security and performance issues similar to eval .

that said, you can easyly parse your string to use function constructor, for example:

 const str = [g,body] = "g => { console.log(g); }".split(" => "); var myFunc = new Function(g, body); myFunc("hello"); const str2 = [args,body] = "(h,i) => {console.log(h,i);}".split(" => "); const [h,i] = args.replace(/\\(|\\)/g,"").split(","); var myFunc2 = new Function(h,i, body); myFunc2("hello","buddy"); 

Answer 2

Anything you do, including your own JS interpreter, is going to be a functional equivalent to eval . Calling eval() function is not a security gap by itself. Executing unsanitized code is what is a security issue, and that's the thing you are trying to do here. Using eval or any equivalent creates an XSS vulnerability.

If you use real interpreter written in JS, you may be able to sandbox the code and mitigate the risk, but it's still a grey area.

OTOH, if you have valid reasons to consider the code in question to be sanitized, there's no good reason to not use eval .

Be aware that you can't reliably sanitize JS code. Anything can be done with very little JS syntax available , so either the code is from a trusted source or it should never be run .

All that said, perhaps the simplest way to get your function compiled with new Function is

(new Function('return ('+code+')'))()

This is almost exact equivalent to calling eval(code) , just without any access to the local namespace. Using eval() directly should be slightly faster (omits creating unnecessary function object).

Answer 3

in theory, this works. Still seems like a bad idea.

var fatso = "g => { alert(g); }";
var s = document.createElement("script");
s.innerText = "function callMe(f) { var a = " + fatso + "; a(f) }"
document.head.appendChild(s);
callMe("hello");