-
-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Closed
Labels
area: 3rd party dependenciestype: bugcode to address defects in shipped codecode to address defects in shipped codetype: securitycode to address security issuescode to address security issues
Description
Describe the bug
netlify-cms
is utilizing eval()
in the published code. Usage of eval()
is generally frowned upon. It also doesn't seem like eval()
is necessary in the majority of its usages.
I noticed one usage of eval(str)
which is also frowned upon. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#Never_use_eval!
To Reproduce
- Go to https://unpkg.com/netlify-cms@2.10.60/dist/netlify-cms.js
- Search for
eval(
Usages:
const utilInspect=eval("require('util').inspect")
eval(str)
var crypto=eval("require('crypto')"),Buffer=eval("require('buffer').Buffer")
Expected behavior
No eval()
s to exist in production code.
Applicable Versions:
- Netlify CMS version: 2.10.60
- Git provider: GitHub
- OS: MacOS X
- Browser version Chrome 85
- Node.JS version: 12.13.0
Metadata
Metadata
Assignees
Labels
area: 3rd party dependenciestype: bugcode to address defects in shipped codecode to address defects in shipped codetype: securitycode to address security issuescode to address security issues