What is the safest way to evaluate a boolean expression that is in string form using JavaScript?

Question

What is the safest way to evaluate a boolean expression that is in string form using JavaScript?

On my quest towards creating a questionnaire, I aim to have questions appear or disappear dynamically based on specific rules represented as strings (e.g.

answers[1] == 'yes' || (answers[2] > 18 && answers[2] < 24)

).

These rules originate from the database and always result in either true or false. If true, the question is displayed, and if false, it remains hidden. Utilizing vue.js for the front-end, these rules are passed as props and need evaluation within a component during runtime.

I am seeking the most effective method to achieve this goal.

In preliminary tests, I experimented with eval() which yielded results. However, I acknowledge its safety risks and hence explore other options.
One alternative involves replacing instances of "answers[x]" with their corresponding values since they are the only variables accessible. Nevertheless, this approach would still require another string for evaluation.
I came across a package named safe-eval that provides a sandboxed eval function where a context can be supplied for access to the answers. While previous versions reportedly had security vulnerabilities, newer updates seem to have addressed them. Would adopting this be a viable solution?
Are there any libraries designed to assist in crafting a parser or offering frameworks for rule creation and evaluation?

Edit: My initial inclination towards utilizing safe-eval over custom parser development stems from its ability to evaluate intricate logic without necessitating an extensive class for handling such complexities.

javascript database parsing vue.js eval

Answer 1

Answer №1

To ensure the string fits your desired format, consider using a regular expression and only proceed with running eval() if it meets the regex criteria. For assistance in creating a regex pattern, I suggest visiting https://regex101.com/

var condition = 'answers[1] > 18';
var regexPattern = /^answers\[\d+\]\s>\s\d+$/;
var answersArray = [8, 27, 64];

if (condition.match(regexPattern))
  console.log(eval(condition));

Answer 2

To ensure the string fits your desired format, consider using a regular expression and only proceed with running eval() if it meets the regex criteria. For assistance in creating a regex pattern, I suggest visiting https://regex101.com/

var condition = 'answers[1] > 18';
var regexPattern = /^answers\[\d+\]\s>\s\d+$/;
var answersArray = [8, 27, 64];

if (condition.match(regexPattern))
  console.log(eval(condition));

Answer 3

Answer №2

To handle rules from the database in JavaScript, consider developing a parser to convert them into functions. The approach will vary depending on the specific structure of the rules you are working with. Here's a simple pseudo-code example:

function parse(string) {
    if (string.match("answers[:d] > :d", question_number, threshold)) {
        return function (answers) {
            return answers[question_number] > threshold;
        };
    }
}
...
answers = [...];
var rule = parse("answers[1] > 18");
if (rule(answers)) {
    // answer[1] > 18
}
else {
    // answer[1] <= 18
}

This parsing method offers better security compared to using eval.

Answer 4

To handle rules from the database in JavaScript, consider developing a parser to convert them into functions. The approach will vary depending on the specific structure of the rules you are working with. Here's a simple pseudo-code example:

function parse(string) {
    if (string.match("answers[:d] > :d", question_number, threshold)) {
        return function (answers) {
            return answers[question_number] > threshold;
        };
    }
}
...
answers = [...];
var rule = parse("answers[1] > 18");
if (rule(answers)) {
    // answer[1] > 18
}
else {
    // answer[1] <= 18
}

This parsing method offers better security compared to using eval.

What is the safest way to evaluate a boolean expression that is in string form using JavaScript?

Answer №1

Answer №2

Similar questions

Incorporating a requirement into a function to ensure it is executed only under certain circumstances

What is the significance of the "component" prop within MUI components?

Reducing ObjectId length in node.js with mongoose

Suggestions on how to refactor redundant code in various peer AngularJS controllers for handling $intervals

What could be the reason behind the Vue property being globally undefined in the component at the time of mounting?

Error: The function Undefined is not recognized by express.io

Tips on how to make the cursor blink in an input text box after tab switching

Is it possible to retrieve a file from a POST request in Express and save it

Is the API for remote asynchronous http calls (Ajax) in Vuejs comparable to that of jQuery?

"Utilizing AngularJS to apply Filter two times within an ng-repeat loop

Learning to Use jQuery to Send JSON Requests in Rails

Creating particle animations using Three.js along a curved path

I am noticing that my state is getting overridden with new posts whenever I add a new one using React hooks and React context. Can

Organizing Jstree on a template to maximize efficiency

Attempting to access a variable without wrapping it in a setTimeout function will

Understand when my task is complete

Utilize the _sortBy function from the lodash library to arrange an array based on a specific field

If a 401 response is encountered in Next.js, automatically navigate to the login page

Generate an AngularJS directive on the fly to dynamically capture user input from the freshly created directive

What methods can be used to retrieve the public holidays for every year with Laravel and JavaScript?