{"action":"opened","issue":{"url":"https://api.github.com/repos/milojs/proto/issues/1","repository_url":"https://api.github.com/repos/milojs/proto","labels_url":"https://api.github.com/repos/milojs/proto/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/milojs/proto/issues/1/comments","events_url":"https://api.github.com/repos/milojs/proto/issues/1/events","html_url":"https://github.com/milojs/proto/issues/1","id":146643815,"number":1,"title":"Unsafe use of eval","user":{"login":"cristianstaicu","id":1549455,"avatar_url":"https://avatars.githubusercontent.com/u/1549455?v=3","gravatar_id":"","url":"https://api.github.com/users/cristianstaicu","html_url":"https://github.com/cristianstaicu","followers_url":"https://api.github.com/users/cristianstaicu/followers","following_url":"https://api.github.com/users/cristianstaicu/following{/other_user}","gists_url":"https://api.github.com/users/cristianstaicu/gists{/gist_id}","starred_url":"https://api.github.com/users/cristianstaicu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristianstaicu/subscriptions","organizations_url":"https://api.github.com/users/cristianstaicu/orgs","repos_url":"https://api.github.com/users/cristianstaicu/repos","events_url":"https://api.github.com/users/cristianstaicu/events{/privacy}","received_events_url":"https://api.github.com/users/cristianstaicu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-07T14:31:16Z","updated_at":"2016-04-07T14:31:16Z","closed_at":null,"body":"In lib/proto_function.js, the following use of eval is dangerous:\r\n```js\r\nfunction makeFunction(arg1, arg2, funcBody) {\r\n    var name = this, count = arguments.length - 1, funcBody = arguments[count], func, code = '';\r\n    for (var i = 0; i < count; i++)\r\n        code += ', ' + arguments[i];\r\n    code = [\r\n        'func = function ',\r\n        name,\r\n        '(',\r\n        code.slice(2),\r\n        ') {\\n',\r\n        funcBody,\r\n        '\\n}'\r\n    ].join('');\r\n    eval(code);\r\n    return func;\r\n}\r\n```\r\n\r\nAs opposed to new Function(), your code do not validate the arguments. Please validate the argument names and the function name by using some regular expression or some more heavy-weighted sanitization like: \r\nhttps://www.npmjs.com/package/eval-sanitizer"}}