Direct vs indirect eval

[mikesamuel]

This is more of an fyi since I have no suggested fix.

applyEvalVillain("eval") turns direct eval into indirect eval

eval_villain/src/js/switcheroo.js

Line 385 in 8c49852

let ep = new evProxy;

Since eval !== %eval%, all eval becomes direct eval.

You can see the difference in

const x = 'indirect';
(() => {
  const x = 'direct';
  console.log(`eval(x) => ${ eval('x') }`);  // -> indirect
  console.log(`(0, eval)(x) => ${ (0, eval)('x') }`);  // -> direct
})();

This happens because of step 6.a in 12.3.4.1

6. If Type(ref) is Reference and IsPropertyReference(ref) is false and GetReferencedName(ref) is "eval", then
   a. If SameValue(func, %eval%) is true, then

when evaluating function calls where the function is the identifier eval.

[swoops]

I was unaware of this behavior.

This could lead to false positives/negatives or breaking sites. It could also be used to identify when Eval Villain is hooking eval in the page.

Thanks

[mikesamuel]

It could also be used to identify when Eval Villain is hooking eval in the page.

Yeah.

function isEvalHooked() {
  var Object = 0;  // Mask the global.
  return eval('typeof Object') !== 'number';
}

console.log(isEvalHooked());  // -> false
eval = new Proxy(eval, {});
console.log(isEvalHooked());  // -> true