Comments on: Extensions & XMLHttpRequest & eval - Oh My http://starkravingfinkle.org/blog/2008/06/extensions-xmlhttprequest-eval-oh-my/ Sat, 22 Nov 2008 14:41:57 +0000 http://wordpress.org/?v=2.6.2 By: Erwan http://starkravingfinkle.org/blog/2008/06/extensions-xmlhttprequest-eval-oh-my/#comment-6857 Erwan Fri, 18 Jul 2008 01:04:07 +0000 http://starkravingfinkle.org/blog/?p=280#comment-6857 According to the doc on MDC, we can evaluate JSON either using the jsm (that actually does an eval in sandbox), or using the native component. Since the native component is much faster than the jsm, is there any reason to use the jsm or should we all use the native component? According to the doc on MDC, we can evaluate JSON either using the jsm (that actually does an eval in sandbox), or using the native component. Since the native component is much faster than the jsm, is there any reason to use the jsm or should we all use the native component?

]]> By: Mark Finkle http://starkravingfinkle.org/blog/2008/06/extensions-xmlhttprequest-eval-oh-my/#comment-6642 Mark Finkle Fri, 27 Jun 2008 14:07:47 +0000 http://starkravingfinkle.org/blog/?p=280#comment-6642 Thanks Giorgio Thanks Giorgio

]]> By: Giorgio Maone http://starkravingfinkle.org/blog/2008/06/extensions-xmlhttprequest-eval-oh-my/#comment-6638 Giorgio Maone Fri, 27 Jun 2008 09:20:57 +0000 http://starkravingfinkle.org/blog/?p=280#comment-6638 <blockquote>Do you happen to know any other functions that we should be worried about other than eval()?</blockquote> <code>new Function(someCode)</code> and <code>node.setAttribute("onSomeEvent", someScript)</code> are two which come to mind. innerHTML can be worrisome too, depending on the context.

Do you happen to know any other functions that we should be worried about other than eval()?

new Function(someCode) and node.setAttribute("onSomeEvent", someScript) are two which come to mind.
innerHTML can be worrisome too, depending on the context.

]]> By: Cesar http://starkravingfinkle.org/blog/2008/06/extensions-xmlhttprequest-eval-oh-my/#comment-6637 Cesar Fri, 27 Jun 2008 05:57:16 +0000 http://starkravingfinkle.org/blog/?p=280#comment-6637 Thank you Mark. This is exactly the kind of message we want sent out to developers :). I have denied at least 3 addons for this very reason. It is rare, but it happens. Never maliciously of course. Do you happen to know any other functions that we should be worried about other than eval()? Thank you Mark. This is exactly the kind of message we want sent out to developers :). I have denied at least 3 addons for this very reason. It is rare, but it happens. Never maliciously of course.

Do you happen to know any other functions that we should be worried about other than eval()?

]]>