The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate...
Transcript of The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate...
![Page 1: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/1.jpg)
The Eval that Men Do
A Large-scale Study of the Use of Eval in JavaScript Applications
by Gregor Richards et al.
Changhee Park @ PLRG
2011. 3. 18
![Page 2: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/2.jpg)
What is eval?
![Page 3: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/3.jpg)
What is eval?
• eval()
String eval() Program
• Ex)
eval(“var a=3; var b=4; a+b”)
7
![Page 4: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/4.jpg)
The power of eval
• What eval can do …
– New library installation
– Adding and removing field and method from objects
– Changing prototype hierarchy
![Page 5: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/5.jpg)
The power of eval
• Scope access
– Global scope : indirect call
• Ex) var anothereval = eval
– Local scope : direct call
• Ex)
![Page 6: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/6.jpg)
Handling eval
• Some researches …
Ignore eval!!
![Page 7: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/7.jpg)
Handling eval
• Some researches …
Assume eval is hardly used
![Page 8: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/8.jpg)
Handling eval
• Some researches …
Assume eval is used safely
• [9] assumes eval is used mainly for JSON deserialization and sometimes for loading of library code
![Page 9: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/9.jpg)
Handling eval
• JSON(JavaScript Object Notation) – EX)
• JSON serialization
– Object -> String
• JSON deserialization
– String -> Object
![Page 10: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/10.jpg)
Handling eval
• Some researches …
Assume eval is a serious security threat
![Page 11: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/11.jpg)
Handling eval
• Summary of assumptions
– eval is hardly used
– eval is safely used
• eval is used primarily for JSON deserialization
– eval is a serious security threat
Which one is true??
![Page 12: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/12.jpg)
This paper
• Conducts a thorough evaluation of the real-world use of eval
![Page 13: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/13.jpg)
Methodology
![Page 14: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/14.jpg)
Methodology
• Infrastructure
– TracingSafari : an instrumented version of WebKit
TracingSafari
Read Write Delete Call
Define …
Traces
Trace Analyzer
Database
Source code
eval string
eval string provenance
![Page 15: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/15.jpg)
Methodology
• Corpus – The most popular top 100 and 10000 sites
according to alexa.com
– Three kinds of executions
![Page 16: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/16.jpg)
Methodology
• Corpus
– The rationale for three data sets
Data Sets Good Bad
Interactive Most representative Small coverage
Pageload Large coverage No interaction
Random Large coverage Unrealistic
![Page 17: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/17.jpg)
Methodology
• Limitation
– No consideration for dynamic code injection provided by DOM
• Ex) document.write, document.createElement(“script”)
– No exhaustive coverage
– Only results in WebKit and Safari
![Page 18: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/18.jpg)
Usage of Eval
![Page 19: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/19.jpg)
JavaScript and eval usase
• Usage statistics(JS percentage)
– The top most 100 : 100 %
– The top most 10000 : 91 %
![Page 20: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/20.jpg)
JavaScript and eval usase
• Usage statistics(JS size)
![Page 21: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/21.jpg)
JavaScript and eval usase
• Usage statistics(JS size)
Outliers
![Page 22: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/22.jpg)
JavaScript and eval usase
• Usage statistics(eval percentage)
– Total 481,833 calls and 317MB string data
– Pageload 41% vs Random 43%
![Page 23: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/23.jpg)
JavaScript and eval usase
• Usage statistics(eval size)
![Page 24: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/24.jpg)
JavaScript and eval usase
• Distribution of eval string sizes
• Below 64B
– Interative : 2/3
– Pageload : 80%
– Random : 85%
• Maximum
– Interactive : 193KB
– Pageload, Random : 413KB
![Page 25: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/25.jpg)
JavaScript and eval usase
• Usage statistics(eval calls)
– eval in the whole life cycle of web pages
– Average eval calls
• Interactive 38 vs Random 85
![Page 26: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/26.jpg)
JavaScript and eval usase
• Distribution of number of eval call sites per site
• Lower mean value in PageLoad
• Max number in PageLoad : 80
![Page 27: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/27.jpg)
JavaScript and eval usase
• Distribution of operation types in eval
• More STORE and CREATE in Interactive : JSON-like object
• More CALL in Random
![Page 28: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/28.jpg)
JavaScript and eval usase
• Common libraries
– Some libraries loaded for dynamism
– MooTools popular in top 100
– Google Closure excluded
![Page 29: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/29.jpg)
A Taxonomy of Eval
![Page 30: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/30.jpg)
Taxonomy of eval
• 4 axes
– Scope
• Changing shared variables violate assumptions
– Patterns
• Enable purpose-specific analyses
– Provenance
• For the analyses related to code injection
– Consistency
![Page 31: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/31.jpg)
A Taxonomy of Eval :
Scope
![Page 32: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/32.jpg)
Scope
• Categorization of the locality
Data Sets Read Write
Purely local Local Local
Writes local, reads module
Module Local
Writes local, reads global
Global Local
Purely module-local
Module Module
Writes module, reads global
Global Module
Global Global Global
![Page 33: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/33.jpg)
Scope
• Scope of eval
• Pure but not self-contained
• Potentially harm
![Page 34: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/34.jpg)
A Taxonomy of Eval :
Patterns
![Page 35: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/35.jpg)
Patterns
• 11 categories 1. JSON 2. Relaxed JSON 3. =JSON 4. Member 5. Variable 6. Variable declaration 7. Typeof 8. Try/catch 9. Call 10. Library 11. Other
![Page 36: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/36.jpg)
Patterns
• 11 categories
1. JSON
- Strict JSON format defined by ECMAScript standard
2. Relaxed JSON
- No quotation or single quotation allowed instead of double quotation
- ex) {x:0}, {‘x’:0}
![Page 37: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/37.jpg)
Patterns
• 11 categories
3. =JSON
- Ex) eval(“v={x:0}”)
4. Member
5. Varaiable
- Easy to access global variables
6. Variable declaration
- Modifies the local scope
![Page 38: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/38.jpg)
Patterns
• 11 categories
7. Typeof
- Ex) typeof(x) != “undefined”
8. Try/catch
9. Call
- Ex) document.getElementById
![Page 39: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/39.jpg)
Patterns
• 11 categories 10. Library
- Each string longer than 512 bytes which defines function
- Why? How?
• Answers – Combination of AJAX(XMLHttpRequest) and
eval prevents page rendering from blocking with <script> tag
– 512 bytes obtained by semantic analysis
![Page 40: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/40.jpg)
Patterns
• 11 categories
11. Other
- Empty string and white space
- Other complex code
![Page 41: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/41.jpg)
Patterns
• The number of web sites
Most are uncategorizable!!
![Page 42: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/42.jpg)
Patterns
• The number of evals
Other : 12.1% Other : 33.1% Other : 17.7%
JSON : 44% Strict JSON
JSON : 21%
CALL : 31%
- Those with side-effect are less common
![Page 43: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/43.jpg)
Rewriting eval
• Rewritable pattern 1. JSON 2. Relaxed JSON 3. =JSON 4. Member 5. Variable 9. Call 7. Typeof 8. Try/catch 6. Variable declaration 10. Library 11. Other
JSON.parse and JSON.stringify
Hashmap access
Simple unwrapping
No rewriting
![Page 44: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/44.jpg)
Rewriting eval
• Rewritable patterns
– Hashmap access
• 4. Member and 5. Variable
– eval(“foo.”+x+“=3;”) => foo[x]=3;
• 9. Call – eval(“update(obj);”) => window[“update”](obj)
![Page 45: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/45.jpg)
Rewriting eval
• Rewritable patterns
– Simple unwrapping
• 7. Typeof
– typeof(x) != “undefined” => “x” in window
• 8. Try/catch
– try{throw v=14} catch(e){} => v=14
![Page 46: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/46.jpg)
Rewriting eval
• Rewritable patterns
– Possible in categories other than Variable declaration, Library, and Other
– 83%
![Page 47: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/47.jpg)
A Taxonomy of Eval :
Provenance
![Page 48: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/48.jpg)
Provenance
• 4 categories
– AJAX : string from AJAX call
– Native/DOM : string from native method or DOM
– Constructed : concatenated string
– Constant
![Page 49: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/49.jpg)
Provenance
• The number of sites
![Page 50: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/50.jpg)
Provenance
• The number of eval strings
AJAX : much less common
![Page 51: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/51.jpg)
Provenance
• Provenance with patterns
JSON is not mainly originated from AJAX!!
![Page 52: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/52.jpg)
Provenance
• JSON non-originated from AJAX
– Ex) google.com
• uses a dynamically created script tag
• JSON string is considered as compile time constant in that tag
• has a separate server with sub-domain containing JavaScript code
• JS code from AJAX is limited by SOP(Same Origin Policy)
![Page 53: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/53.jpg)
Provenance
• Provenance with patterns
![Page 54: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/54.jpg)
A Taxonomy of Eval :
Consistency
![Page 55: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/55.jpg)
Consistency
• Inconsistent evals : 431 call sites
• EX)
– Constant switch
: “4” -> “5” -> “a”
– Field <–> method
: window.location -> dw_lnf.get(dw_Inf.ar) -> dw_lnf.x0()
– JSON <–> non-JSON
: “(null)” -> “(undefined)”
![Page 56: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/56.jpg)
Contribution
• Infrastructure tracking JavaScript behavior
• Large scale survey over 10,000 most popular websites
• Detailed analysis of eval in JavsScript
Utilize it for the further research
![Page 57: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/57.jpg)
Lessons
• eval is hardly used
- False
- 59% of the most popular websites
• eval is safely used
- Partly true
- Assignment and declarations are less common
![Page 58: The Eval that Men Do · Taxonomy of eval •4 axes –Scope •Changing shared variables violate assumptions –Patterns •Enable purpose-specific analyses –Provenance •For the](https://reader034.fdocuments.in/reader034/viewer/2022050100/5f3feef690f5687d95120454/html5/thumbnails/58.jpg)
Lessons
• eval is used primarily for JSON deserialization
- False
- At most 45%
• 83% of eval can be rewritten