eval_is_evil.js

new (function() {
	const someObject = {
		config: {
			key: {
				hello: 'world',
				hola: 'friend'
			}
		}
	};

	const inputFromSomewhere = `hello="friend"
		;;; // malicious input starts here
		var oFn = Math.random;
		Math.random = (...args) => console.log(process.env) || oFn(...args);` // this could be even way worse if Proxy is used.

	eval(`someObject.config.key.${inputFromSomewhere}`); // dev thought it'd be awesome to do a dynamic assignment. Meh. No.

	console.log(Math.random());
	console.log(someObject.config.key.hello);
})();

Hi