Eval Scope

src/reqwest.js

@@ -20,6 +20,7 @@
  , xmlHttpRequest = 'XMLHttpRequest'
  , xDomainRequest = 'XDomainRequest'
  , noop = function () {}
+ , gEval = function(s) { return win.eval.call(win, s) }
 
  , isArray = typeof Array.isArray == 'function'
  ? Array.isArray
@@ -306,13 +307,13 @@
  switch (type) {
  case 'json':
  try {
- resp = win.JSON ? win.JSON.parse(r) : eval('(' + r + ')')
+ resp = win.JSON ? win.JSON.parse(r) : gEval('(' + r + ')')
  } catch (err) {
  return error(resp, 'Could not parse JSON in response', err)
  }
  break
  case 'js':
- resp = eval(r)
+ resp = gEval(r)
  break
  case 'html':
  resp = r
@@ -341,7 +342,7 @@
 
  function timedOut() {
  self._timedOut = true
- self.request.abort() 
+ self.request.abort()
  }
 
  function error(resp, msg, t) {

tests/fixtures/poison.js

@@ -0,0 +1,5 @@
+// Die immediately
+self = null
+
+// Common in global scope, e.g. Prism.js+File@
+// self = window

tests/tests.js

@@ -1821,6 +1821,22 @@
  })
  })
 
+ sink('JavaScript', function (test, ok) {
+ test('Poisoning Scope Variables', function (complete) {
+ ajax({
+ url: '/tests/fixtures/poison.js'
+ , type: 'js'
+ , success: function () {
+ ok(
+ true // Enough to be here
+ , 'test cannot fail if reached'
+ )
+ complete()
+ }
+ })
+ })
+ })
+
  start()
 
 }(reqwest))