On Jul 3, 2014, at 6:13 AM, Mahendran Pandian wrote: > Hi Team, > we are using prototype.js for past 8 years in our product development, > Recently our organization introduced code scanner(HP Fortify) to verify any > code vulnerable in the product. The scanner identified as > prototype.js&script.aculo.us uses eval and math.rondom, with is insecure. > > Can we able to remove/drop the usage of those functions in prototype.js? or > is there any alternative way to achieve without using those functions? >
Prototype uses eval in a few places, notably in the Ajax callbacks to instantiate embedded scripts (evalScripts: true). I think that it may use it when building up a JSON callback, too, but I haven't toured that part of the code recently enough to tell you for certain. I recommend you read through the source from top to bottom, identify the spots where eval is used (not many, IIRC) and see if they intersect your usage of the library. Try commenting them out and see what happens to your code. That's the only way to be sure. Prototype is a largish library, and it stands to reason that nobody uses all of it all the time. By the way, blindly grepping for `eval` is a fairly naive way to do security. If your program sanitizes its inputs, there's no harm in evaluating those inputs, in my opinion. Walter > > Thanks, > Mahendran.. > > -- > You received this message because you are subscribed to the Google Groups > "Prototype & script.aculo.us" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to prototype-scriptaculous+unsubscr...@googlegroups.com. > To post to this group, send email to prototype-scriptaculous@googlegroups.com. > Visit this group at http://groups.google.com/group/prototype-scriptaculous. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Prototype & script.aculo.us" group. To unsubscribe from this group and stop receiving emails from it, send an email to prototype-scriptaculous+unsubscr...@googlegroups.com. To post to this group, send email to prototype-scriptaculous@googlegroups.com. Visit this group at http://groups.google.com/group/prototype-scriptaculous. For more options, visit https://groups.google.com/d/optout.
