How does jQuery getScript method ensure secure execution of dynamically loaded JavaScript?

Question

I want to dynamically load JS file using AJAX and execute it. I am referring this page which says, "At this time,the preferred way of injecting JS code seems to be to use AJAX to load the JS source, then eval() the code."

But I am worried of using eval to execute the script. Just to see how jQuery implements this I checked its source and found this:

getScript: function( url, callback ) {
    return jQuery.get( url, undefined, callback, "script" );
}

Then I searched for jQuery get method. But there are several get methods defined. I am new to OOP in JS and don't understand where to look for the correct get method.

I want to know how it executes the script - whether it uses eval or not and if yes, how is it secure.

Can someone guide me how I can look for the correct get method.

jAndy · Accepted Answer · 2011-06-06 23:44:19Z

5

There is nothing to ensure "security" (that actually can't be done).
It is on you to just load trusted scripts.

After some delegating, jQuery will call a method called "globalEval" which either runs .execScript() (IE) or a standard window.eval() on the transfered script files. Either way, the script which gets executed has access to anything.

answered Jun 6, 2011 at 23:44

jAndy

237k57 gold badges313 silver badges363 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Cracker Over a year ago

So if I load a trusted script there is no problem using eval to execute it?

David Tang Over a year ago

@Cracker, it's the same as if you included it with a <script> tag in your HTML.

Collectives™ on Stack Overflow

How does jQuery getScript method ensure secure execution of dynamically loaded JavaScript?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related