Closed (fixed)
Project:
Search Autocomplete
Version:
7.x-2.x-dev
Component:
Code
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
24 May 2012 at 17:22 UTC
Updated:
6 Sep 2012 at 11:38 UTC
There's no need for eval() here:
/js/jquery.autocomplete.js
(function ($) {
15 $(document).ready(function() {
16 $.each(Drupal.settings.search_autocomplete, function(key, value) {
17 var obj = 'Drupal.settings.search_autocomplete.' + key;
18 $(eval(obj + '.selector') + ' input:first').autocomplete(
19 eval(obj + '.url'), {
20 dataType: "json",
21 cacheLength : 20,
22 matchContains: true,
23 minChars: eval(obj + '.minChars'),
24 selectFirst: false,
25 max: eval(obj + '.max_sug')
26 }).result(function () {
27 $(this).get(0).form.submit();
28 }).focus();
29 });
30 });
31 }(jQuery)) ;
There's no need for eval() for basic string concatenations or accessing properties, it just allows for very unexpected behavior if one of the key strings happens to be "void(alert('I can do anything here!')) || actual-id-key". (yeah, not likely, but still...).
It should be something like: (untested)
(function ($) {
15 $(document).ready(function() {
16 $.each(Drupal.settings.search_autocomplete, function(key, value) {
17 var obj = value; // value already is Drupal.settings.search_autocomplete[key] so you could replace obj with value.
18 $(obj.selector + ' input:first').autocomplete(
19 obj.url, {
20 dataType: "json",
21 cacheLength : 20,
22 matchContains: true,
23 minChars: obj.minChars,
24 selectFirst: false,
25 max: obj.max_sug
26 }).result(function () {
27 $(this).get(0).form.submit();
28 }).focus();
29 });
30 });
31 }(jQuery)) ;
Comments
Comment #1
dom. commentedHi !
Thanks a lot for noticing and reporting. I will correct that for next version.
Comment #2
dom. commentedFixed in 7.x-3.x