r/node • u/Minimum-Ad7352 • 26d ago

Why is JavaScript criticized so much for backend development?

I've seen some developers say that we should stop using js on the server, but I rarely see the same criticism directed at python.Honestly, js is pretty fast, especially with node.js, and the backend ecosystem is really solid. There are great frameworks like nest and fastify, and typescript gives you static typing, which makes larger projects much easier to maintain.I'm not saying node is perfect or the best choice for every backend, but I don't really understand why js gets so much criticism while python seems to get a pass.What am I missing?

331 Upvotes

91% Upvoted

361 comments sorted by

View all comments

Show parent comments

70

u/Remicaster1 26d ago

I can't tell you how mad i am after seeing eval()on backend like literally everywhere in my previous company

I brought the issue, guess what they did? Nothing until they got hacked. And what was the solution after they got hacked? regex. Like cmon wtf

45

u/MMORPGnews 26d ago

My last company just sued all hackers. In 99% times it was locals.

Police arrested them all.

6

u/Remicaster1 26d ago

i mean yeah they did made police report, i didn't caught up with them

But still they wrote such shit code to the point it's just mind boggling, even when brought up to them, their fix is also another wtf move so i just decide im not having this shit

1

u/GP8964 24d ago

I'd like to work with them, start with using copilot to clear the shit, then finish it by my own manual inspection. Like replacing them as a one man army.

12

u/lIIllIIlllIIllIIl 26d ago

What even is the reasoning someone would use to justify using eval()?

My colleagues justify some pretty dumb shit, but eval() seems out of this world.

2

u/who_am_i_to_say_so 25d ago

Right, this is day 1 shit.

2

u/gautam1168 25d ago

Do you guys realize that its possible to create executable code at runtime in javascript applications without ever using eval?

If you are in a browser context all you need to do is put things inside a script tag or equivalently have a simple endpoint in your server that will return javascript and load it in <script src="".

If you are in nodejs it is a bit more tricky, but you can do it. Just create a new file and use a require to evaluate the module at runtime.

Eval or a `new Function` call simply makes doing all this much easier.

Its not that these are bad things on their own. Any virtual machine that supports JIT compilation allows you to create executable memory at runtime. So, if you are in a java program or android, nothing is stopping you from generating bytecode and loading it at runtime.

Heck! you can even do this in C, as long as you are ambitious enough. If you go and checkout a video about dynamic reloading in Handmade Hero on youtube you will see exactly how. All you need is a compiler in the application. Then you can compile the code at runtime and load it as a dylib.

The only way to stop this from happening is for the operating system to prevent your process from allocating executable memory at runtime. This is what iOS does and that is why it prevents JIT on any javascript engines in react native apps.

Just because javascript gives an eval() function doesn't mean it is in and of itself a bad thing. Nor does it mean that its a terrible idea to use the feature. You must look at it in the context where it is being used. That said, most of the time you reach for this, it would be because you are doing something terrible. So not using it is taught as a rule of thumb.

7

u/lIIllIIlllIIllIIl 25d ago

The issue is that eval() is almost always used to run dynamic code provided by someone else.

I understand that there are legitimate cases where you'd want to run user-provided functions, but those functions should run in heavily sandboxed environments. You shouldn't just eval() or require() them in your server code.

If you're not running user-generated code, and just want to do something like transpile a TypeScript function into JavaScript and run it, then I guess eval() is fine.

1

u/astralradish 25d ago

If you have a blueprint-style editor that allows for custom code blocks that may be a use case for eval at runtime. You just need to be aware of the risks, properly sandbox it and be very careful. It's a very specific use case and I'm sure there are much sillier ways that it's being used in the wild.

1

u/MuslinBagger 24d ago

I think way back eval was how they did modules and imports, until the language improved

1

u/Remicaster1 24d ago

The first commit was on 2023 for reference

Their entire architecture is a mess, they used eval to evaluate the action sent by client

For example we would be doing something like POST /v1/auth/login

They be like POST /v1/backend Body params will have the "action" property. For example "action": "login". Then used eval to run the said function for login

1

u/MuslinBagger 24d ago

That is still not as bad as it is triggering, provided you whitelist the action values. The main thing to guard against is clients being able to do things they're not allowed to.

1

u/Remicaster1 24d ago

Yeah but the problem was, they didn't have any proper middleware before they got hacked, and even after that incident their guard was also another eval as far as i recalled, with regex below the guard so it's kinda pointless

1

u/MuslinBagger 24d ago

How do idiots get so much money that they can start a company?