Is javascript eval really that big of a security threat?
eval, javascript
Solution
When you hand-over control of JavaScript, it isn't just its execution that could prove harmful. With Ajax, you could possibly load a flash object, or a pdf, or a Java applet, into the current page itself. That would present no dialog and you would be invoking plugins (which have a lot more privileges than the browser itself).
So, in theory, it could cause as much damage as your plugins themselves allow, which is usually quite a lot.
Problem
Assuming there is no browser-side security loophole that can be used to modify someone's computer, I don't understand how using `eval` could lead to any real threat. Could someone explain how that could be possible. Someone could display something on a user's computer, but no real harm could be done without a redirection or accepted download. No server-side damage could be done, right?