Simon Willison’s Weblog

Subscribe
Atom feed for eval

2 items tagged “eval”

2008

eval() Kerfuffle. The ability to read supposedly private variables in Firefox using a second argument to eval() will be removed in Firefox 3.1.

# 2nd July 2008, 9:24 pm / firefox, eval, security, privacy, javascript, john-resig

Session variables without cookies. Brilliant but terrifying hack—you can store up to 2 MB of data in window.name and it persists between multiple pages, even across domains. Doesn’t work with new tabs though, and storing JSON in it and eval()ing it is a bad idea—a malicious site could populate it before sending the user to you.

# 13th May 2008, 9:59 pm / javascript, json, crossdomainstorage, sessions, eval, security