---
id: 280
title: "DOM Invader and the case of direct eval vs indirect eval"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/dom-invader-and-the-case-of-direct-eval-vs-indirect-eval"
published_at: "2023-09-25 14:00"
tags: ["portswigger-research", "dom-invader", "dom-xss", "javascript", "eval"]
phying_url: "https://phying.com/item/280"
lang: en
---

# DOM Invader and the case of direct eval vs indirect eval

## Summary

Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-09-25 14:00
- **Original:** https://portswigger.net/blog/dom-invader-and-the-case-of-direct-eval-vs-indirect-eval
- **Phying News:** https://phying.com/item/280