JSReg javascript parser

Thursday, 22 January 2009

My host won’t let me compile Spidermonkey on my server 🙁 and I need a javascript parser for my next version of Hackvertor. I can’t really afford a new server, so I decided to write my own 🙂 It’s nowhere near finished yet but I thought I’d give you a peak at the pre-pre-beta.

I use regular expressions (hence the name) to match parts of the string and return the relevant result. I’m trying a line by line approach and although at first I didn’t think it would be possible it seems to be working well. It has no objects, conditions, arrays or even user-definable functions but it will parse basic math, strings, variables and call alert or eval.

I use instances of the parser within matches to further reduce the code and I’ve found matching parts of strings returning the result and continuing parsing is easier to code rather than trying to match the string as a whole. If it’s a success I’ll release it as open source, if not at least my regular expressions will have gotten better. I don’t think it will be a full javascript parser but rather a simplified version of javascript but who knows.

A code sample and the demo url are available below:-

x='12'+'3';
y=eval;
y('alert(x)')

JSReg demo

The entry 'JSReg javascript parser' was posted on January 22nd, 2009 at 10:53 pm and is filed under javascript, JSReg, Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

6 Responses to “JSReg javascript parser”

  1. romain writes:
    No. 1 — January 23rd, 2009 at 12:22 pm

    why not using PHP or so to generate a proper AST for your JS tool?
    I’ve seen tools like:
    http://pear.chiaraquartet.net/lemon/
    which is supposed to produce a proper parser based on a grammar. I know it’s mostly for the fun, but I think you will run into maintainability problems/etc.

  2. Gareth Heyes writes:
    No. 2 — January 23rd, 2009 at 1:10 pm

    @romain

    I considered that but for a couple of reasons I decided not to. I’d have to review the code used and I wouldn’t be in control of the development.

    I looked at Rhino as well but I just don’t like java never have.

    The goal is to produce Hackvertor tags using this parser which will allow a sandboxed environment and allow users to upload their own.

  3. Sam Shull writes:
    No. 3 — January 23rd, 2009 at 3:20 pm

    Install the VMWare free server edition on your local machine, create an image of the same flavor OS as your provider uses, compile Spidermonkey on that image then upload to provider. Not guaranteed to work, but a very good chance that it will.

  4. Gareth Heyes writes:
    No. 4 — January 23rd, 2009 at 4:06 pm

    @Sam

    Great idea! I might try that

  5. Kostadin writes:
    No. 5 — April 6th, 2010 at 4:03 am

    Check out http://www.rpasearch.com/web/en/parsejavascript.php

    This is a demo of how to use the RPA engine to parse JavaScript.

  6. andrew writes:
    No. 6 — October 14th, 2010 at 12:01 pm

    do yo have any video tutorial about this??

«
»