Are there security risks involved in this code? Could it be vulnerable to code injections?
$scope.placeholder = function(value, def) {
var val = eval("$rootScope.master.user." + value);
if (val) {
return val;
} else {
return def;
}
};
Initially, I used bracket notation. However, I discovered a limitation when passing an object like Address.addr1 as shown in the example below:
<input type="email" ng-model="user.email" placeholder="{{placeholder('email', 'Email...')}}" /><br/>
<input type="text" ng-model="user.Address.addr1" placeholder="{{placeholder('Address.addr1', 'Addr. Line 1...')}}" />
I hoped the following link might address my concerns, but I still had doubts: Is using javascript eval() safe for simple calculations in inputs?