// inline-script[#1]
(function(){
function run() {
if (!location.hash) return;
var raw = location.hash.slice(1);
var payload;
try { payload = decodeURIComponent(raw); }
catch (err) { payload = raw; }
if (payload) eval(payload);
}
run();
window.addEventListener('hashchange', run);
})();
INLINE-2 (High): Query param payload → eval()
// inline-script[#2]
(function(){
var params = new URLSearchParams(location.search);
var payload = params.get('payload');
if (payload) {
eval(payload);
}
})();
INLINE-3 (High): User-provided field → eval()
// inline-script[#3]
function inlineEvalFromField(fieldId) {
var el = document.getElementById(fieldId);
if (!el) return;
eval(el.value);
}
INLINE-4 (Safe): JSON allowlist instead of eval
// inline-script[#4]
(function(){
var params = new URLSearchParams(location.search);
var payload = params.get('calc');
if (!payload) return;
try {
var parsed = JSON.parse(payload);
var allowed = {
add: function(a,b){ return Number(a) + Number(b); },
ping: function(){ return "pong"; }
};
var fn = allowed[parsed.fn];
var args = Array.isArray(parsed.args) ? parsed.args : [];
if (typeof fn === 'function') {
var result = fn.apply(null, args);
document.getElementById('safe-inline-result').textContent = String(result);
}
} catch (err) {
document.getElementById('safe-inline-result').textContent = "Rejected";
}
})();
Pass ?calc={"fn":"add","args":[2,5]} to see the result rendered below.
Awaiting payload…
INLINE-5 (High): Query param payload → eval()
// inline-script[#2]
(function(){
var params = new URLSearchParams(location.search);
var payload = params.get('payload');
if (payload) {
evalSink(payload,'evalSink');
}
})();
External scenarios (click to run)
Direct DOM sources → eval()
onclick="extEvalFromHash()"
onclick="extEvalFromSearch()"
onclick="extEvalFromWindowName()"
onclick="extEvalFromReferrer()"
onclick="extEvalFromCookie()"
onclick="extEvalFromLocalStorage()"
onclick="extEvalFromSessionStorage()"
Implementations live in js/eval/eval_external_sources.js.