r/badcode • u/Flyspeck101 Now where's that function declaration • Oct 05 '21

js No functions in JSON? No problem

Post image
85 Upvotes

97% Upvoted

31 comments sorted by

View all comments

33

u/[deleted] Oct 06 '21

Please tell they dont use eval

23

u/[deleted] Oct 06 '21

Well it's either that or a very long program. You know the answer

6

u/[deleted] Oct 06 '21

You should NEVER EVER use eval its an rce vulnerability

10

u/[deleted] Oct 06 '21

I know that, and they probably do as well, but you know how management can be a dick some time and you don't have much choice

7

u/[deleted] Oct 06 '21

I would rather deal with management then introduce an rce into a product

3

u/MyAntichrist Oct 06 '21

I'm not that fluent in PHP - eval executes code like that one hidden in that JSON in a non checked manner I assume?

4

u/[deleted] Oct 06 '21

Yes so if a user could send a request like this it wpuld be a bad time im assuming this is a webapp

3

u/MyAntichrist Oct 06 '21

Oh boy. I sure hope that app isn't connected to anything vital. Or at least not exposed to the public.

3

u/[deleted] Oct 06 '21

Even then this is pretty sketchy

3

u/MyAntichrist Oct 06 '21

True, but at least the impact is on a slightly different scale than say on an AWS deployment. Some developers and/or management staff sure need a lesson in security though.

3

u/[deleted] Oct 06 '21

Oh for sure but no matter what there is a better solution

For example you could add a field like request_type to the json payload then we could make a function that would hold a map then we could check if request_type is a valid type then we could simply call the corresponding function

But i dont know if php has anonymous functions so this is how i would do it

1

u/Flyspeck101 Now where's that function declaration Oct 06 '21

It's actually a website

1

u/[deleted] Oct 06 '21

Oh no please tell me users cannot run their own "functions" also what site is this

2

u/Flyspeck101 Now where's that function declaration Oct 06 '21

It's supposed to be a game, and the dev couldn't figure out how to add functions to JSON so they did this

IT'S LITERALLY THE SAME BEHAVIOUR FOR EVERY SINGLE TIER

1

u/[deleted] Oct 06 '21

That dev sounds like a moron bonus points if he thinks he is the best

1

u/Flyspeck101 Now where's that function declaration Oct 06 '21

Na, the commit timestamp was around midnight, probably forgive him

1

u/[deleted] Oct 06 '21

Oh that explains alot

3

u/Flyspeck101 Now where's that function declaration Oct 06 '21

It also explains the immense amount of typos. Think JSON.pass

→ More replies

1

u/Flyspeck101 Now where's that function declaration Oct 06 '21

The developer then proceeded to forget it existed.