Search code examples
javascriptkotlineval

Is Kotlin eval() dangerous?

I read in the documentation of Javascript:

eval() is a dangerous function, which executes the code it's passed with the privileges of the caller. If you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension.

My question is: it is same thing in Kotlin? If so, why it was implemented, considering Kotlin a more advanced and modern language?

Solution

  • When using Kotlin for JavaScript projects the Kotlin code will be transpiled to JavaScript code. To provide full compatibility also eval() is available. And to answer the main question:

    Yes, eval() used in Kotlin code is as dangerous as using it in JavaScript code and should be avoided for the same reasons you already mentioned in your question.

    When using Kotlin for a JVM based Project or Native Project, you don't have access to the eval-function, because it is only compatible with JavaScript.