diff --git a/sharedPlugins/inventoryImports/interfacingFunctions.js b/sharedPlugins/inventoryImports/interfacingFunctions.js index 3f7f2903..4b4736c6 100644 --- a/sharedPlugins/inventoryImports/interfacingFunctions.js +++ b/sharedPlugins/inventoryImports/interfacingFunctions.js @@ -3,22 +3,6 @@ const needle = require("needle"); const pluginConfig = require("./config") const isJson = require("./isJson") -// returns JS object, throws if there are syntax errors in input string -function parseJsString(string){ - // eval because my lua is writing a JS object instead of traditional JSON - // this was done because I hate escaping strings and there are more quotes - // in JSON than JS objects. - - // since eval is unsafe, maybe use https://www.npmjs.com/package/eval-sanitizer - if(string.includes("require") || string.includes(";") || string.includes("eval")){ - throw new Error("parseJsString might have gotten something that could be a xss attempt"); - } - let inventory = ""; - eval("inventory = " + string); - /*console.log(string) - console.log(inventory)*/ - return inventory; -} function handleInventory(json, config, callback){ /* json is one of these two samples @@ -151,7 +135,6 @@ function pollInventories(outputFile){ module.exports = { handleInventory: handleInventory, - parseJsString: parseJsString, pollInventories: pollInventories, insertItemsFromObject: insertItemsFromObject, } \ No newline at end of file diff --git a/sharedPlugins/inventoryImports/interfacingFunctions.spec.js b/sharedPlugins/inventoryImports/interfacingFunctions.spec.js index 17eb4996..3b1da5a4 100644 --- a/sharedPlugins/inventoryImports/interfacingFunctions.spec.js +++ b/sharedPlugins/inventoryImports/interfacingFunctions.spec.js @@ -157,23 +157,4 @@ describe("inventoryImports/interfacingFunctions.js", function(){ assert(isFactorioCommand(x) == true); }); }); - describe("parseJsString(string) => object", function(){ - it("converts a string with JS object notation to object", function(){ - let x = functions.parseJsString("{hello:'thisAString!', yes:function(){return 'JS string!'}, not:'json'}"); - assert(!!x == true, "Should under no circumstance return a falsey value, even !!{} is truthy"); - assert(typeof x == "object", "parseJsString should return an object in this case"); - assert(typeof x.yes == "function", "parseJsString is not JSON, so it should be able to contain functions"); - }); - it("*Tries* to avoid XSS attempts by throwing on certain symbols", function(){ - assert.throws(function(){ - let x = functions.parseJsString("{};throw 'fail'"); - }, function(err) { - let error = err+"" - /* istanbul ignore else */ - if(error.includes('parseJsString might have gotten something that could be a xss attempt')){ - return true; - } - }, "should throw when ; are passed because those are the simplest form of xss"); - }); - }); -}); \ No newline at end of file +});