luci-base: xhr.js: use JSON.parse() and pass request duration to callbacks

JSON.parse() is supported on all modern browsers and a far better
solution than the hakish and potentially dangerous eval().

Also calculate the duration of request and pass it as 3rd argument to the
callback function, this makes it easier to calculate request delays or
poll intervals in code using XHR.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 5 insertions, 3 deletions

diff --git a/modules/luci-base/htdocs/luci-static/resources/xhr.js b/modules/luci-base/htdocs/luci-static/resources/xhr.js
index f1537a4481..5bedaefaad 100644
--- a/modules/luci-base/htdocs/luci-static/resources/xhr.js
+++ b/modules/luci-base/htdocs/luci-static/resources/xhr.js
@@ -43,6 +43,7 @@ XHR = function()
 	{
 		this.reinit();
 
+		var ts   = Date.now();
 		var xhr  = this._xmlHttp;
 		var code = this._encode(data);
 
@@ -65,14 +66,14 @@ XHR = function()
 				var json = null;
 				if (xhr.getResponseHeader("Content-Type") == "application/json") {
 					try {
-						json = eval('(' + xhr.responseText + ')');
+						json = JSON.parse(xhr.responseText);
 					}
 					catch(e) {
 						json = null;
 					}
 				}
 
-				callback(xhr, json);
+				callback(xhr, json, Date.now() - ts);
 			}
 		}
 
@@ -83,13 +84,14 @@ XHR = function()
 	{
 		this.reinit();
 
+		var ts   = Date.now();
 		var xhr  = this._xmlHttp;
 		var code = this._encode(data);
 
 		xhr.onreadystatechange = function()
 		{
 			if (xhr.readyState == 4)
-				callback(xhr);
+				callback(xhr, null, Date.now() - ts);
 		}
 
 		xhr.open('POST', url, true);