TABLE OF CONTENTS

• How It Works
• What Is Blocked
  • 1. Accessing Cookies
  • 2. Using eval()
  • 3. Using new Function()
  • 4. Using setTimeout() With a String
  • 5. Using setInterval() With a String
  • 6. Reading From localStorage
• What Is Allowed
• Important Notes
• If Your Code Is Being Blocked

How It Works

When editing custom HTML:

1. Open Form / Survey / Quiz Builder
2. Add an HTML element
3. Click Edit HTML
4. Enter your code

The editor automatically scans the code in real time.

If a security issue is found:

• A red error message appears below the editor
• The Save button is disabled
• You must remove the unsafe code before saving

What Is Blocked

The editor blocks high-risk JavaScript patterns that can expose sensitive data.

1. Accessing Cookies

Blocked:

Also blocked:

Cookies may contain authentication data. Accessing them can lead to account compromise.

2. Using eval()

Blocked:

eval() executes arbitrary strings as code and can be used to hide malicious scripts.

3. Using new Function()

Blocked:

This dynamically executes string-based code and poses the same risks as eval().

4. Using setTimeout() With a String

Blocked:

Allowed:

Passing a string causes the browser to evaluate it as code.

5. Using setInterval() With a String

Blocked:

Allowed:

6. Reading From localStorage

Blocked:

Reading from localStorage may expose sensitive session or authentication data.

Allowed:

What Is Allowed

The following are not blocked:

• Standard HTML
• Safe JavaScript logic
• Arrow functions
• Function references in timers
• Writing to localStorage
• sessionStorage usage

Important Notes

• Detection is case-insensitive (eval, EVAL, etc.).
• If the same issue appears multiple times, only one error message is shown.
• Empty HTML fields are allowed.
• Pure HTML (without scripts) is allowed.

If Your Code Is Being Blocked

To resolve the issue:

• Remove any direct cookie access
• Avoid eval() or new Function()
• Use function references instead of string-based timers
• Do not read authentication or session data from localStorage