Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Removing eval (function constructor) #5863

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 434 commits into
base: main
Choose a base branch
Loading
from

Conversation

Juraj-Masiar
Copy link

Many linters complains about evals, so removing the legacy Function('return this')() will greatly help!

What about compatibility?
The existing globalThis has a great support for 5 years now, including Node 12, Deno 1.0, Safari 12.1, Chrome 71, Firefox 65: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis#browser_compatibility

Prior to globalThis, the only reliable cross-platform way to get the global object for an environment was Function('return this')(). However, this causes CSP violations in some settings, so authors would use a piecewise definition like this (slightly adapted from the original core-js source):

This issue has been reported many times in this and many other repositories:
https://github.com/lodash/lodash/issues?q=eval
most recent: #5862

jdalton and others added 30 commits March 12, 2017 00:06
One example now shows that specifying a padding length of less than the
length of the string returns the entire original string.
falsyvalues and others added 29 commits October 17, 2019 11:23
Since `function flow(funcs)` changed to `function flow(...funcs)` this ternary became unnecessary, since funcs will always have a length now.
The return type should be `boolean` instead of `number`
Remove the unused param `hash` from the jsdoc of `Hash#delete`
…dash#4681)

--save is a command-line option and it should be monospaced

Co-authored-by: utkarsh-kukreti <utkarshk@dewsolutions.in>
The `opt-cli` pre-push functionality was removed from lodash just a few days
after it was added (see lodash@2cd12c3),
but the documentation encouraging contributors to use it still remains.
Remove to avoid confusion for new contributors.
The master branch has been in flux for a pretty long time, so leaving
the broken npm scripts and messages in CONTRIBUTING.md doesn't make
sense and has been confusing to contributors. This commit removes broken
npm scripts and removes all unnecessary dependencies for now.
I've commented out a test for `_.merge` and will re-look it as I
gradually cleanup the codebase.
`npm cit` is short for `npm ci` and `npm test`
Signed-off-by: tison <wander4096@gmail.com>
* test: fix throttle.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix pickBy.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix isBuffer.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: partially fix attempt.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: partially fix dropRightWhile.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix defer.spec.js and rest.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix invoke.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix isArray.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: partially fix iteration-methods.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix xor-methods.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix property.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix ary.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix omit-methods.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix debounce-and-throttle.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix unzip-and-zip.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix toPairs-methods.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix exit-early.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: temporarily comment out takeWhile and dropWhile tests

Signed-off-by: tison <wander4096@gmail.com>

* test: partially fix union*.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix startsWith-and-endsWith.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix isNil.spec.js

Signed-off-by: tison <wander4096@gmail.com>

* test: fix some of syntax errors

Signed-off-by: tison <wander4096@gmail.com>

---------

Signed-off-by: tison <wander4096@gmail.com>
Signed-off-by: tison <wander4096@gmail.com>
Many linters complains about evals, so removing the legacy `Function('return this')()` will greatly help!

**What about compatibility?**
The existing `globalThis` has a great support for 5 years now, including Node 12, Deno 1.0, Safari 12.1, Chrome 71, Firefox 65:  
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis#browser_compatibility
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

Morty Proxy This is a proxified and sanitized view of the page, visit original site.