Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / Languages / JScript / October 2004

Tip: Looking for answers? Try searching our database.

JScript.NET eval security issue

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Marian Veteanu - 15 Oct 2004 20:39 GMT
Hello,

I've created a JScript.NET assembly that, basically, exposes the
JScript.NET eval function. I'm using then this assembly from a C#
application.

The code of the JScript.NET package is the following:

import System
import StarLIMS.Web.XfdRuntime.XfdForms

package StarLIMS.Web.XfdRuntime.JSSupport
{
    class JSEvaluator
    {
        public var window : StarLIMS.Web.XfdRuntime.XfdForms.Form;

        public function alert(s : String)
        {
            System.Windows.Forms.MessageBox.Show(s);
        }

        public function Eval(expr : String) : String
        {
            return eval(expr, "unsafe");
        }
    }
}

The assembly was compiled using jsc.exe compiler using a like this:

jsc /t:library /r:XfdForms.dll;System.Windows.Forms.dll
/out:JsSupport.dll JsSupport.js

I've compiled the JScript.NET assembly with a reference to
XfdForms.dll because I need to create in the interpreted code (that
goes to eval function) types defined in that assembly.

The C# application is basically a user control that is hosted in two
environments:

-    in a windows application;
-    in a web application via an <OBJECT> tag.

In both situations the initialization of the user control works fine
(I've adjusted the security settings in order to appear in browser).

The problem appears ONLY in the web scenario, when I'm trying to call
from inside the C# application, the JSEvaluator.Eval method with a
code that creates a type defined in my XfdForms.dll assembly:

var a = new MyCustomType();

I receive this message:

Variable ‘MyCustomType' has not been declared.

I've looked with gacutil /ldl and all assemblies are downloaded
correctly. If I place myself the assemblies in the GAC using "gacutil
–I" then this error doesn't appear.

Please help me with any advice!

Marian VETEANU
System Analyst
Research & Development Dept.
STARLIMS Corporation

Email: marianv@starlims.com
Phone: +1-954-964-8663 Ext.44
bruce barker - 15 Oct 2004 21:18 GMT
.net code running in the browser can not make any unsafe calls. you will
have to set the browser to fully trust the assembly.

-- bruce (sqlwork.com)

> Hello,
>
[quoted text clipped - 66 lines]
> Email: marianv@starlims.com
> Phone: +1-954-964-8663 Ext.44

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.