Research on Safe Parsing and Evaluation of String Mathematical Expressions in JavaScript

In JavaScript development, processing mathematical expressions in string format is a common requirement, such as converting user input like '1+2*3' to the numerical result 7. Although JavaScript provides the built-in eval() function that can directly execute such expressions, due to its security risks (potential execution of malicious code) and performance issues, it is generally advisable to avoid using it in production environments. This paper systematically explores several safe alternatives, with a focus on parsing methods based on regular expressions.

Problem Background and Challenges

Parsing mathematical expressions involves multiple technical aspects: first, identifying numbers and operators within the expression; then performing calculations according to mathematical precedence rules (such as multiplication and division taking priority over addition and subtraction); while also handling complex cases like positive/negative numbers and parentheses. Direct string processing faces numerous challenges, such as accurately splitting expressions, handling operator precedence, and ensuring calculation accuracy.

Core Parsing Method Analysis

Based on the best answer from the Q&A data (Answer 4), we can implement a parser specifically designed for addition operations. The core approach of this method is:

1. Using regular expressions to validate whether the input string format conforms to mathematical expression standards
2. Splitting the expression into an array of numbers using the split('+') method
3. Calculating the sum of all elements in the array

Here is the complete improved implementation code:

function evaluateExpression(expression) {
    // Validate expression format: supports positive/negative integers and addition operations
    const isValid = /^(-?\d+)(\+-?\d+)*$/.test(expression);
    
    if (!isValid) {
        return NaN; // Return NaN to indicate parsing failure
    }
    
    // Split expression and calculate total sum
    const numbers = expression.split('+');
    let sum = 0;
    
    for (let i = 0; i < numbers.length; i++) {
        // Use unary plus operator to convert string to number
        sum += +numbers[i];
    }
    
    return sum;
}

// Usage examples
console.log(evaluateExpression('1+2+3'));        // Output: 6
console.log(evaluateExpression('10+-5+3'));      // Output: 8
console.log(evaluateExpression('1+2*3'));        // Output: NaN (multiplication not supported)

Method Advantages and Limitations

The advantages of this approach include:

• High Security: Completely avoids the security risks of eval()
• Controllable Performance: Time complexity of O(n), suitable for scenarios with numerous calculations
• Clear Code: Simple and straightforward logic, easy to understand and maintain

However, this method also has significant limitations:

• Only supports addition operations, cannot handle multiplication, division, parentheses, etc.
• The regular expression is relatively simple and may not cover all edge cases
• Additional extensions are needed to support decimals and scientific notation

Extension Approaches Discussion

To handle more complex mathematical expressions, consider the following extension directions:

1. Supporting Four Basic Operations

By introducing operator precedence handling, support for addition, subtraction, multiplication, and division can be extended. The basic approach involves first converting the expression to postfix notation (Reverse Polish Notation), then using a stack for calculation:

function parseComplexExpression(expr) {
    // Implement Reverse Polish Notation conversion
    // This is a simplified example; actual implementation requires complete syntax analysis
    const tokens = expr.match(/\d+|[+\-*/()]/g);
    // ... Subsequent processing logic
}

2. Supporting Decimals and Floating-Point Numbers

Modify the regular expression to support decimal points and floating-point formats:

const decimalPattern = /^(-?\d+(\.\d+)?)(\+-?\d+(\.\d+)?)*$/;

3. Integrating Existing Math Libraries

As mentioned in Answer 1, libraries like math.js provide complete mathematical expression parsing capabilities:

import { evaluate } from 'mathjs';
const result = evaluate('1.2 * (2 + 4.5)'); // Returns 7.8

Performance and Security Considerations

In terms of performance, custom parsers are generally more efficient than eval() because they avoid the complete parsing process of the JavaScript engine. Regarding security, by restricting acceptable characters and patterns, code injection attacks can be effectively prevented.

For production environments, it is recommended to:

1. Perform strict format validation on input
2. Limit expression complexity and length
3. Consider using mature math libraries (like math.js) for more complete functionality
4. Perform additional validation and calculations on the server side

Practical Application Recommendations

Choose appropriate solutions based on specific requirements:

• Simple Addition Scenarios: Use the basic method introduced in this paper
• Complex Mathematical Operations: Recommend using mature libraries like math.js
• Educational or Demonstration Projects: Try implementing a complete syntax parser to deeply understand compilation principles

By reasonably selecting technical solutions, developers can effectively handle the evaluation requirements of string mathematical expressions while ensuring security.