Wondering what’s next for npm?Check out our public roadmap! »

    loophole

    1.1.0 • Public • Published

    Eval Loophole Build Status

    This is a hack to enable third-party libraries that depend on a limited subset of eval semantics to work in Atom with a content security policy that forbids calls to eval.

    {allowUnsafeEvalallowUnsafeNewFunction} = require 'loophole'
     
    allowUnsafeEval ->
      crazyLibrary.exploitLoophole() # allows `eval(...)` 
     
    allowUnsafeNewFunction ->
      crazyLibrary.exploitLoophole() # allows `new Function(...)` 

    You can also use the exported Function constructor directly:

    {Function} = require 'loophole'
    = new Function("return 1 + 1;")

    How?

    allowUnsafeEval replaces eval with a call to vm.runInThisContext, which won't perfectly emulate eval but is good enough in certain circumstances, like compiling PEG.js grammars.

    allowUnsafeNewFunction temporarily replaces global.Function with loophole.Function, which passes the source of the desired function to vm.runInThisContext.

    Why?

    If there's a loophole, why even enable CSP? It still prevents developers from accidentally invoking eval with legacy libraries. For example, did you know that jQuery runs eval when you pass it content with script tags? If you want eval, you'll need to explicitly ask for it.

    Keywords

    none

    Install

    npm i loophole

    DownloadsWeekly Downloads

    21,793

    Version

    1.1.0

    License

    MIT

    Last publish

    Collaborators

    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar