Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove eval sink #480

Merged
merged 2 commits into from
Dec 18, 2024
Merged

Remove eval sink #480

merged 2 commits into from
Dec 18, 2024

Conversation

timokoessler
Copy link
Contributor

The eval function provided by the V8 Engine has a built in security feature preventing access to the local scope in non direct eval calls. For example while eval("__dirname") works, (0, eval)("__dirname) does not work, because the first call will have a local scope and the second call a global scope.

const test = eval;

// All the following lines crash
test("__dirname");
test.call(this, __dirname);
test.apply(this, ["__dirname"]);

https://tc39.es/ecma262/multipage/global-object.html#sec-eval-x

Copy link

codecov bot commented Dec 18, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!

@hansott hansott merged commit 2bb2e37 into main Dec 18, 2024
10 checks passed
@hansott hansott deleted the remove-eval-sink branch December 18, 2024 17:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants