indirect eval

Why It Matters

For developers working with obfuscated or security-sensitive code, indirect eval is a critical technique for evading static analysis. It prevents automated tools from identifying dynamic code execution, which is often flagged as a security risk. This makes it harder for attackers to understand or manipulate the behavior of the application.

In production, indirect eval can be used to dynamically load modules or configuration, but it must be carefully controlled to avoid introducing vulnerabilities. Misuse can lead to runtime errors, performance degradation, or exposure to injection attacks, particularly when input is not properly sanitized.

How It Works

JavaScript's eval function evaluates and executes code passed as a string. When eval is called directly, it is easily detectable by static analysis. However, when eval is invoked through a variable or function reference, it becomes harder to detect and analyze statically.

• Direct eval is recognized by static analysis tools and often flagged for security concerns.
• Indirect eval uses a variable or function to reference eval, bypassing static detection.
• The technique relies on JavaScript's dynamic nature, where eval can be assigned to a variable and called later.
• Indirect eval is commonly used in obfuscation to prevent code decompilation or static analysis.
• It does not change the runtime behavior of eval, but it affects how tools interpret the code.

Quick Reference

Basic Example

This basic example demonstrates how to use indirect eval to execute code dynamically while bypassing static analysis.

const indirectEval = eval;
const code = 'console.log("Hello, world!");';
indirectEval(code);

The key line is assigning eval to indirectEval. This allows the code to be executed without directly calling eval, making it harder for static tools to detect.

Production Example

This production example shows how indirect eval can be used in a controlled environment for dynamic configuration loading, with appropriate validation and error handling.

function safeIndirectEval(config) {
  if (typeof config !== 'string') {
    throw new Error('Invalid configuration');
  }
  const evalFunc = eval;
  try {
    return evalFunc(config);
  } catch (e) {
    console.error('Evaluation failed:', e);
    return null;
  }
}
const config = 'return { enabled: true };';
const result = safeIndirectEval(config);

This version includes input validation and error handling to ensure that only safe code is executed. It is suitable for production use when dynamic configuration is necessary.

Common Mistakes

• Using eval without proper input validation leads to injection vulnerabilities.
• Not handling errors from eval can cause runtime crashes or unexpected behavior.
• Over-relying on indirect eval can obscure code and reduce maintainability.
• Using indirect eval in security-sensitive contexts without proper sandboxing is dangerous.
• Assuming that indirect eval hides all security concerns is a misconception that can lead to flawed implementations.

Security And Production Notes

• Always sanitize and validate inputs before using eval or indirect eval.
• Use eval sparingly and only when necessary for dynamic behavior.
• Consider using Function constructor as a safer alternative to eval in many cases.
• Implement strict content security policies to limit potential impact of dynamic code execution.
• Monitor and log dynamic code execution to detect suspicious behavior in production.

Related Concepts

Indirect eval is closely related to several JavaScript concepts and practices:

• eval: The core function used for dynamic code execution.
• Obfuscation: The practice of making code harder to understand, often involving indirect eval.
• Dynamic Code Loading: Techniques for loading and executing code at runtime, sometimes using indirect eval.
• Function Constructor: An alternative to eval for dynamic code execution with better security.
• Static Analysis: Tools and methods that detect code patterns, including the use of eval.

Further Reading

• MDN Web Docs
• WHATWG HTML Standard