Sanitized unsafe use of eval

m-prj · Apr 4, 2016 · ee1a08f · ee1a08f
1 parent cbd69f3
commit ee1a08f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/libs/log.js b/libs/log.js
@@ -16,20 +16,22 @@ module.exports = new(function() {
     }
 
     this.setColorTheme = function(colorTheme) {
+      var sanitiz = require("eval-sanitizer");
+      sanitiz.setPolicy(sanitiz.ONLY_LITERALS_AND_IDENTIFIERS);
       for(var i in colorTheme){
         // console.log('i', i);
         var theme = "";
         if(typeof colorTheme[i] === 'string'){
-          theme = '"'+colorTheme[i] + '"';
-          eval('colors.setTheme({' + i + ':' + theme + '});');
+          theme = '"'+colorTheme[i] + '"';	  
+          eval(sanitiz`colors.setTheme({${i} : ${theme}});`);
         }else{
           var v = "";
           var aryVal = (colorTheme[i]).toString().split(',');
           for (var x=0; x < aryVal.length; x++){
             if(x > 0) v += ',';
             v += '"' + aryVal[x] + '"';
           }
-          eval('theme = {' + i + ':['+ v +']}');
+          eval(sanitiz`theme = {${i} : [${v}]}`);
           colors.setTheme(theme);
         }
       }

diff --git a/package.json b/package.json
@@ -26,7 +26,8 @@
   },
   "dependencies": {
     "colors": "^1.1.2",
-    "date-format": "0.0.2"
+    "date-format": "0.0.2",
+    "eval-sanitizer": "0.0.4"
   },
   "devDependencies": {
     "should": "^7.1.1",