[JENKINS-60866] Remove eval calls from JSON parsing in form controls (#…

…6868) Co-authored-by: Daniel Beck <daniel-beck@users.noreply.github.com>
jenkinsci · Jul 21, 2022 · 7fd9f22 · 7fd9f22
1 parent 83a2335
commit 7fd9f22
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/core/src/main/resources/lib/form/combobox/combobox.js b/core/src/main/resources/lib/form/combobox/combobox.js
@@ -16,8 +16,8 @@ Behaviour.specify("INPUT.combobox2", 'combobox', 100, function(e) {
             new Ajax.Request(e.getAttribute("fillUrl"),{
                 parameters: params,
                 onSuccess : function(rsp) {
-                    items = eval('('+rsp.responseText+')');
+                    items = JSON.parse(rsp.responseText);
                 }
             });
         });
-});
+});
diff --git a/core/src/main/resources/lib/form/select/select.js b/core/src/main/resources/lib/form/select/select.js
@@ -45,7 +45,7 @@ function updateListBox(listBox,url,config) {
 
         var selectionSet = false; // is the selection forced by the server?
         var possibleIndex = null; // if there's a new option that matches the current value, remember its index
-        var opts = eval('('+rsp.responseText+')').values;
+        var opts = JSON.parse(rsp.responseText).values;
         for( var i=0; i<opts.length; i++ ) {
             l.options[i] = new Option(opts[i].name,opts[i].value);
             if(opts[i].selected) {