canmove, Confirmed users
1,448
edits
| Line 158: | Line 158: | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | | ||
|- style="vertical-align: top;" | |- style="vertical-align: top;" | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Using eval, Function() | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Using eval, Function(), setTimeout, setInterval to evaluate remote code | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Reject | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Reject | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | | ||
| Line 190: | Line 190: | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Keep in mind these can be used inside strings. They're just not allowed to replace JS code characters, since they're usually meant to bypass the validator. | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Keep in mind these can be used inside strings. They're just not allowed to replace JS code characters, since they're usually meant to bypass the validator. | ||
|- style="vertical-align: top;" | |- style="vertical-align: top;" | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Using eval, Function() | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Using eval, Function(), setTimeout, setInterval to evaluate local code | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Preliminary Review | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | Preliminary Review | ||
| style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | One case that we accept is when eval is used to replace existing Firefox functions. This is very common for add-ons that change bookmarking or tabbing behavior. It is also allowed in known libraries like jQuery. | | style="padding: .5ex 1ex 1ex 0; border-bottom: 1px solid black;" | One case that we accept is when eval is used to replace existing Firefox functions. This is very common for add-ons that change bookmarking or tabbing behavior. It is also allowed in known libraries like jQuery. | ||