Hacker News Reader

Unless the code you've written uses eval and passes user-provided data to the eval function, there's no way to inject code. JavaScript also has an eval function that and code injection is not a worry at run-time for Node projects unless they're using eval() as well.

But where's the eval? Unlike certain other languages (cough Java python), reading quoted s-exps has no side-effect.

I’ve never thought about this, that’s interesting, would escaping or coercing params help with this?