fix(security): unsafe use of eval() for code execution

Multiple JavaScript rule files use eval() to parse dynamic content, allowing arbitrary code execution if the server returns malicious data. Found in js/海洋听书.js, js/有声小说吧.js and others. Affected files: 海洋听书.js Signed-off-by: tuanaiseo <[email protected]>
2026-05-07 06:07:34 +07:00
parent 826b826d21
commit ab7e2d7e5c
1 changed files with 1 additions and 1 deletions
@@ -33,7 +33,7 @@ var rule = {
            let v = pd(html, ".booksite&&script&&Html");
            var document = {};
            var VideoListJson;
-            VideoListJson = eval(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
+            VideoListJson = JSON.parse(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
            // log(typeof VideoListJson);
            let list1 = VideoListJson[0][1];
            LISTS = [list1];