[ACCUMULO-4590] Use JSON.parse instead of eval on client side javascript

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.6, 1.7.2, 1.8.0, 2.0.0
• Fix Version/s: 1.7.3, 1.9.0
• Component/s: monitor
• Labels: security
• Assignee: Christopher Tubbs
• Reporter: Sean Busbey
• Created: 21/Feb/17 16:06
• Updated: 23/Apr/19 16:13
• Resolved: 22/Feb/17 19:24

Description

Right now we rely on "eval" to decode json results in the monitor display:

vis.js

function handleNewData() {
  if (xmlhttp.readyState!=4) {
    return;
  }
  if (xmlhttp.status!=200 || xmlhttp.responseText==null) {
    xmlReturned = true;
    return;
  }
  var newstats = eval('(' + xmlhttp.responseText + ')');

We should instead use JSON.parse