Develop Reference

Node - safest way to execute code from a string during runtime

My Node app gets an HTML page via axios, parses it via htmlparser2 then sends the valuable information to a frontend JS app as JSON.
The HTML page has some JavaScript in it that creates an array, and I need to work with that array in my code. htmlparser2 gets the content of the script as a string. I have two options to handle it as far as I know:
Write a parser that goes through the string and extracts the required info (doable, but complicated)
Run string as some JavaScript code and handle the values from that.
Assume I want to go with option 2. According to this StackOverflow question, using Node's VM module is possible, but the official documentation says "The node:vm module is not a security mechanism. Do not use it to run untrusted code."
I consider the code in my use case untrusted. What would be a safe solution for this?
EDIT: A snippet from the string:
hatizsakCucc = new Array();
hazbanCucc = new Array();
function adatokMessage(targyIndexStr,tomb) {
var targyIndex = parseInt(targyIndexStr);
if (tomb.length<1) alert("Nincs semmi!");
else alert(tomb[targyIndex]);
}
hatizsakCucc[0]="Név: ezüst\nSúly: 0.0001 kg.\nMennyiség: 453\nÖsszsúly: 0.0453 kg.\n";
hatizsakCucc[1]="Név: kaja\nSúly: 0.4 kg.\nÁr: 2 ezüst\nMennyiség: 68\nÖsszár: 136 ezüst\nÖsszsúly: 27.2 kg.\n";
hatizsakCucc[2]="Típus: fegyver\nNév: bot\nSúly: 2 kg.\nÁr: 6 ezüst\nMin. szint: 1\nMaximum sebzés: 6\nSebzés szórás: 5\nFajta: ütő/zúzó\n";
hatizsakCucc[3]="Típus: fegyver\nNév: parittya\nSúly: 0.3 kg.\nÁr: 14 ezüst\nMin. szint: 1\nMaximum sebzés: 7\nSebzés szórás: 4\nFajta: távolsági\n";
hatizsakCucc[4]="Név: csodatarisznya\nSúly: 4 kg.\nÁr: 1000 ezüst\nExtra: templomi árú\n";
hatizsakCucc[5]="Név: imamalom\nSúly: 5 kg.\nÁr: 150 ezüst\nExtra: templomi árú\n";
The whole string is about 100 lines of this, so it's not too much data.
What I need is the contents of the hatizsakCucc array. Actually, getting an array of that it not too difficult with a regex, I'm realizing now.
hatizsakSzkript.match(/hatizsakCucc(.*)\\n/g);
This gives me an array of the hatizsakCucc elements, so I guess my problem is solved.
That said, I'm still curious about the possibility of running "untrusted" code safely.
Further context:
I plan parse each array element so it will be an object, the object elements will be the substring separated by the \n-s
So the expected result for the first array element will be:
hatizsakCucc[0]{
nev: "ezüst",
suly: 0.0001,
mennyiseg: ...
}
I'll write a function that splits the string to substrings at the \n then parse the data with a match().

Passing multiple dynamic values from a web form to SSRS

I have inherited code that was written by someone else. The code takes a "number" and passes it to an SSRS report. I have modified the report to include 5 more alpha numeric strings that I need passed to the report. Here is the initial code:
var h = "SSRSRepBrowserParameters.aspx?rs:ID=b2d543c2-1cce-487b-a3c0-743baa5933e1&QuoteNumberParameter=";
var q = $('.HdrTitle').eq(1).html();
var x;
x = q.split(" - ")\[1\];
x = x.replace('.','');
x = x.replace(/^0+/, '');
x = x.replace('.','');
$("#btnPrintVendReq").ready(function(){ $("#btnPrintVendReq").click(function(){
window.open(h+x '\_self');});});
I surprisingly understand what the guy did using variables to make this:
\*\*class="HdrTitle"\> Quote Form - 00.019.000 \*\*
look like this:
19000
What I need to do is add 5 more dynamic values that are in the web form and append them to the URL passed to SSRS.
In the web form the values are FreeTextField_10...11...12...13...14 and will be passed into the URL as ItemNo1...ItemNo2...ItemNo3...ItemNo4...ItemNo5:
\*\*class="saveHistory Text" name="FreeTextField_10" id="FreeTextField_10" value="2764-06" \*\*
So if all that mess makes sense the end result I need the window.open to pass a URL that shows:
SSRSRepBrowserParameters.aspx?rs:ID=b2d543c2-1cce-487b-a3c0-743baa5933e1&QuoteNumberParameter=19000&ItemNo1=2764-06&ItemNo2=2764-06&ItemNo3=2764-06&ItemNo4=2764-06&ItemNo5=2764-06
I was actually impressed that I was able to figure out what I need and hard coding it works...but unfortunately the vales come from a web form and will change so it's the pesky variables that throw me off here.
Unfortunately I have not been able to come up with the correct syntax to successfully pass the variables to the report.

Converting Java code to JS (jsweet error)

I wrote a code in Java which gets number of each piece type and fills some area with tetris block and print filled array.
I wanted to make website (probably on github.io, no server) which calculates this and print for other users.
I wrote the code in Eclipse(jdk 12.0.2) and no error on it.
But when I convert code with JSweet, it gave me some errors:
1.
final EnumMap<P,Integer> M = new EnumMap<>(P.class);
->type 'P' does not satisfy the constraint 'Enum<P>'
2.
EnumMap<P,Integer> M = (something);
Iterator<Piece> P = new ArrayList<>(M.keySet().iterator());
->property 'slice' does not exist on type 'Set<P>'
Then I found GWT, but it seems like wont work without server... I tried it but it failed.
How to fix errors on JSweet? Or is there other apps to convert Java code to js?
(This is my first project in Java and Eclipse, and newbie in js)

Different names - JS and CS

Im Trying to get to the same text on JS and on CS
JS CODE:
var LblSits = document.getElementById('<%=SelectedSits.ClientID%>');
LblSits.textContent+= NumId;
CS Code:
int Sits = int.Parse(SelectedSits.Text);
When i Run This , i can see the SelectedSits Label updating with numbers
but when im trying to Debug it from the CS its always empty ("").
the diffrence of the names driving me crazy.
same happened to me With ImageUrl on CS and src on JS until i figured it out.
Which name connected to whom?
What can i do?
Why is that always empty?

From the C# code, you can only see content that is changed in JavaScript code for specific controls that support sending the changes made by JavaScript on the client back to the server.
Instead of using a Label, use a TextBox or HiddenField control.

Debugging dynamically generated/loaded JavaScript code INSIDE the host JavaScript

The title probably isn't saying much at all, but hopefully it got someone interested.
The actual problem is quite simple.
I want to make a web application that loads JavaScript code dynamically (might even be a hardcoded string) as a string, then I want to run that code line by line and analyze the debug info every step.
Basically, I need a JavaScript interpreter/debugger written in JavaScript.
Hopefully, I'd be able to do something like this
var source = "var a = 5; var b = a; b = 6"
var vm = new VirtualMachine(source);
vm.step();
vm.getDebugInfo();
and it would tell me about the local variables and their values.

This project hasn't been updated in a while but maybe you could build something for your purpose around it
https://github.com/jterrace/js.js/ - A JavaScript JavaScript interpreter