bigskysoftware / bigskysoftware/htmx
Additional braces added to JavaScript passed to eval
- Dominant language
- JavaScript
- Stars
- 49.4k
- Forks
- 1.7k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 30
Description
https://github.com/bigskysoftware/htmx/blob/master/src/htmx.js#L2902-L2917
```javascript
if (str.indexOf("javascript:") === 0) {
str = str.substr(11);
evaluateValue = true;
} else if (str.indexOf("js:") === 0) {
str = str.substr(3);
evaluateValue = true;
}
if (str.indexOf('{') !== 0) {
str = "{" + str + "}";
}
var varsValues;
if (evaluateValue) {
varsValues = maybeEval(elt,function () {return Function("return (" + str + ")")();}, {});
} else {
varsValues = parseJSON(str);
}
```
The first part makes it possible to use `js:` or `javascript:` to supply values, instead of using JSON. If I understand correctly, this makes it possible to do something like this:
```
```
However, curly braces (`{`, `}`) are added around the payload, even when it is JavaScript. So htmx tries to execute the following:
```javascript
({createHeaders()})
```
and this is invalid syntax.
Contributor guide
Assessment
This issue has not been assessed yet.