CS Fundamentals Trainer · JavaScript · Security

Which of these can execute an attacker-controlled string str as JavaScript?

Which of these can execute an attacker-controlled string `str` as JavaScript?

  1. `eval(str)`
  2. `el.textContent = str`
  3. `setTimeout(str, 0)`
  4. `new Function(str)`
  5. `JSON.parse(str)`

Difficulty: easy

Answer this question

Related questions