Web Security · Middle · Question 4 of 75

Why is `eval(userInput)` or `new Function(userInput)` always dangerous?

1It's only slow, not a security problem
2Because it doesn't work in strict mode
✓Correct answer: It runs any string as code with the page's privileges

Explanation

If any part of the string comes from users, they control the code. Strict CSP also blocks these calls unless 'unsafe-eval' is set.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.