Is there a better way than eval() in this scenario?

Question

It is a web app, using Google Apps Script, running as the user accessing the app.

We have custom data and code for some users.

That custom information is in a text file within the developer's Google Drive, with only View access from the specific user.

The content of that text file could be like below dummy code:

var oConfig = {
  some : "OK",  
  getinfo : function (s) {
    return this.some + s;
  }
}

In order to get that custom data / code into the app, we can use eval() as shown below:

  var rawjs = DriveApp.getFileById(jsid).getBlob().getDataAsString();
  eval(rawjs);
  Logger.log(oConfig.getinfo("?")); // OK?

My questions are:

1. Is there a better way to achieve this goal than eval()?

2. Is eval() secure enough in this case, considering that the text file is only editable by the developer?

Thanks, Fausto

Answer 1

Well, it looks secure enough. But using eval has other problems, like making it difficult to debug your code, and possibly some other problems.

If you're generating such custom data within your code, I imagine the variety of such customizations is enumerable. If so, I'd leave the code within your script and save in Drive just data and use indicators (like function variants names) of how to rebuild the config object in your script. For example:

function buildConfig(data) {
  var config = JSON.parse(data); //only data, no code
  config.getInfo = this[config.getInfo]; //hook code safely
  return config;
}

function customInfo1(s) { return this.some + s; }

function customInfo2(s) { return s + this.some; }

function testSetup() {
  //var userData = DriveApp.getFileById(jsid).getBlob().getDataAsString();
  var userData = '{"some":"OK", "getInfo":"customInfo1"}'; //just for easier testing

  var config = buildConfig(userdata); //no eval

  //let's test it
  Logger.log(config.getInfo('test'));
}