security - Modules in Javascript with eval(); -


every javascript developer knows; eval evil

but since looking ultimative module technology in javascript, read interesting using eval module loader, has 2 main benefits:

  • faster loading mobile, because loading whole string @ once
  • script seperating without doing fancy define wrappers require.js in each module

so whats that? , solution, load several functions through eval? mean security aspects...

edit: sry forgot link article: article

because of high-latency on 3g connections single http request, more data, lot faster multiple smaller requests.

what article proposes combining multiple modules 1 file this:

var modules = {     'main.js': 'alert("main module")',     'another.js': 'alert("another module")',     'notused.js': 'alert("i never used")', }; 

that way can downloaded single http request faster, , can still include/evaluate modules need.

e.g. do:

var requirefile = function(file) {     if(modules[file])         eval(modules[file]); };  requirefile('main.js'); requirefile('another.js'); 

and main.js , another.js evaluated, notused.js ignored.

security wise, shouldn't different including them via <script> tag provided whatever use combine scripts can't accidentally combine/include other files/strings too.

so security perspective, there shouldn't difference above , this:

<scruipt src="main.js"></script> <scruipt src="another.js"></script> 

of course still have other disadvantages of eval.


Comments