Skip to content

fix: Replace dangerous eval with safe calculator implementation#2

Open
surajyog wants to merge 1 commit intoTech-Net-bit:mainfrom
surajyog:feature/fix-security-and-add-docs
Open

fix: Replace dangerous eval with safe calculator implementation#2
surajyog wants to merge 1 commit intoTech-Net-bit:mainfrom
surajyog:feature/fix-security-and-add-docs

Conversation

@surajyog
Copy link
Copy Markdown

@surajyog surajyog commented Feb 4, 2026

Summary

This PR addresses a critical security vulnerability by removing the dangerous eval() function and replacing it with a safe calculator implementation.

Changes

  • ✅ Removed dangerousCalc function that used eval()
  • ✅ Added safeCalculator function with proper input validation
  • ✅ Implemented parentheses balancing checks
  • ✅ Added comprehensive JSDoc documentation

Security Improvements

  • Prevents arbitrary code execution
  • Validates input to only allow mathematical expressions
  • Providing clear error messages for invalid input
  • Uses Function constructor with sanitization instead of eval

Testing

The new safeCalculator function:

  • ✅ Handles basic arithmetic operations
  • ✅ Supports parentheses
  • ✅ Rejects malicious input
  • ✅ Validates parentheses balancing

- Remove security vulnerability caused by eval() usage
- Add safeCalculator function with input validation
- Implement parentheses balancing checks
- Add JSDoc documentation for all functions
- Add comprehensive README with usage examples and security notes

This contribution improves code security by:
- Preventing arbitrary code execution
- Validating input to only allow mathematical expressions
- Providing clear error messages for invalid input
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants