There's no need for eval() here:
/js/jquery.autocomplete.js

(function ($) {
15   $(document).ready(function() {
16     $.each(Drupal.settings.search_autocomplete, function(key, value) {
17       var obj = 'Drupal.settings.search_autocomplete.' + key;
18       $(eval(obj + '.selector') + ' input:first').autocomplete(
19         eval(obj + '.url'), {
20         dataType: "json",
21         cacheLength : 20,
22         matchContains: true,
23         minChars: eval(obj + '.minChars'),
24         selectFirst: false,
25         max: eval(obj + '.max_sug')
26       }).result(function () {
27         $(this).get(0).form.submit();
28       }).focus();
29     });
30   });
31 }(jQuery)) ;

There's no need for eval() for basic string concatenations or accessing properties, it just allows for very unexpected behavior if one of the key strings happens to be "void(alert('I can do anything here!')) || actual-id-key". (yeah, not likely, but still...).

It should be something like: (untested)

(function ($) {
15   $(document).ready(function() {
16     $.each(Drupal.settings.search_autocomplete, function(key, value) {
17       var obj = value; // value already is Drupal.settings.search_autocomplete[key] so you could replace obj with value.
18       $(obj.selector + ' input:first').autocomplete(
19         obj.url, {
20         dataType: "json",
21         cacheLength : 20,
22         matchContains: true,
23         minChars: obj.minChars,
24         selectFirst: false,
25         max: obj.max_sug
26       }).result(function () {
27         $(this).get(0).form.submit();
28       }).focus();
29     });
30   });
31 }(jQuery)) ;

Comments

dom.’s picture

Hi !

Thanks a lot for noticing and reporting. I will correct that for next version.

dom.’s picture

Status: Active » Closed (fixed)

Fixed in 7.x-3.x