Extensions & XMLHttpRequest & eval - Oh My

Using eval() to decode JavaScript you downloaded from a remote website in your extension is just plain wrong. It’s not safe! Don’t do it!

Every now and then, an AMO reviewer will send me an email asking me to help an extension developer workaround the situation. Why? Because AMO will not allow add-ons that eva() JavaScript downloaded from a remote website to be moved out of the AMO sandbox. It’s not safe! Using eval() in an extension can give rogue JavaScript chrome privileges - the ability to do pretty much whatever it wants to the computer.

I finally made an MDC article with more details. The short version is:

• If you’re downloading JSON, use a real JSON decoder, not eval().
• If you’re downloading real JavaScript, use a JavaScript sandbox, not eval().