From ab7e2d7e5c273f7e9b7c9c1860ee0e1def0575c3 Mon Sep 17 00:00:00 2001
From: tuanaiseo <tuanaiseo@gmail.com>
Date: Thu, 7 May 2026 06:07:34 +0700
Subject: [PATCH] fix(security): unsafe use of eval() for code execution
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Multiple JavaScript rule files use eval() to parse dynamic content, allowing arbitrary code execution if the server returns malicious data. Found in js/海洋听书.js, js/有声小说吧.js and others.

Affected files: 海洋听书.js

Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
---
 js/海洋听书.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/海洋听书.js b/js/海洋听书.js
index d364cad7..f6df43d6 100644
--- a/js/海洋听书.js
+++ b/js/海洋听书.js
@@ -33,7 +33,7 @@ var rule = {
             let v = pd(html, ".booksite&&script&&Html");
             var document = {};
             var VideoListJson;
-            VideoListJson = eval(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
+            VideoListJson = JSON.parse(v.split("VideoListJson=")[1].split(",urlinfo")[0]);
             // log(typeof VideoListJson);
             let list1 = VideoListJson[0][1];
             LISTS = [list1];