@n8n/tournament - npm Package Compare versions

Comparing version 1.0.1 to 1.0.2

dist/index.d.ts

 import type { ExpressionAnalysis } from './ExpressionBuilder';
-import type { ExpressionEvaluatorClass } from './Evaluator';
 export type { TmplDifference } from './Analysis';
-export type { ExpressionEvaluator, ExpressionEvaluatorClass } from './Evaluator';
 export type ReturnValue = string | null | (() => unknown);
@@ -9,8 +7,8 @@ export declare class Tournament {
     private _dataNodeName;
-    private evaluator;
-    constructor(errorHandler?: (error: Error) => void, _dataNodeName?: string, Evaluator?: ExpressionEvaluatorClass);
-    setEvaluator(Evaluator: ExpressionEvaluatorClass): void;
+    private _codeCache;
+    constructor(errorHandler?: (error: Error) => void, _dataNodeName?: string);
     getExpressionCode(expr: string): [string, ExpressionAnalysis];
     tmplDiff(expr: string): import("./Analysis").TmplDifference;
+    private getFunction;
     execute(expr: string, data: unknown): ReturnValue;
 }

dist/index.js

@@ -6,13 +6,9 @@ "use strict";
 const Analysis_1 = require("./Analysis");
-const FunctionEvaluator_1 = require("./FunctionEvaluator");
 const DATA_NODE_NAME = '___n8n_data';
 class Tournament {
-    constructor(errorHandler = () => { }, _dataNodeName = DATA_NODE_NAME, Evaluator = FunctionEvaluator_1.FunctionEvaluator) {
+    constructor(errorHandler = () => { }, _dataNodeName = DATA_NODE_NAME) {
         this.errorHandler = errorHandler;
         this._dataNodeName = _dataNodeName;
-        this.setEvaluator(Evaluator);
+        this._codeCache = {};
     }
-    setEvaluator(Evaluator) {
-        this.evaluator = new Evaluator(this);
-    }
     getExpressionCode(expr) {
@@ -24,2 +20,11 @@ return (0, ExpressionBuilder_1.getExpressionCode)(expr, this._dataNodeName);
     }
+    getFunction(expr) {
+        if (expr in this._codeCache) {
+            return this._codeCache[expr];
+        }
+        const [code, analysis] = this.getExpressionCode(expr);
+        const func = new Function('E', code + ';');
+        this._codeCache[expr] = [func, analysis];
+        return [func, analysis];
+    }
     execute(expr, data) {
@@ -29,3 +34,4 @@ if (!expr) {
         }
-        return this.evaluator.evaluate(expr, data);
+        const fn = this.getFunction(expr)[0];
+        return fn.call(data, this.errorHandler);
     }
@@ -32,0 +38,0 @@ }

dist/VariablePolyfill.js

@@ -24,3 +24,2 @@ "use strict";
 };
-const polyfillExceptions = ['this', 'window', 'global'];
 const polyfillVar = (path, dataNode, force = false) => {
@@ -32,5 +31,2 @@ if (!force) {
     }
-    if (polyfillExceptions.includes(path.node.name)) {
-        return;
-    }
     path.replace(buildGlobalSwitch(path.node, dataNode));
@@ -37,0 +33,0 @@ };

package.json

 {
   "name": "@n8n/tournament",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Output compatible rewrite of riot tmpl",
@@ -5,0 +5,0 @@ "main": "dist/index.js",

src/ExpressionBuilder.ts

@@ -23,2 +23,4 @@ import type { namedTypes } from 'ast-types';
 
+const shouldAlwaysWrapList = ['window', 'global', 'this'];
+
 const shouldWrapInTry = (node: namedTypes.ASTNode) => {
@@ -36,2 +38,10 @@ let shouldWrap = false;
 		},
+		visitIdentifier(path) {
+			if (shouldAlwaysWrapList.includes(path.node.name)) {
+				shouldWrap = true;
+				return false;
+			}
+			this.traverse(path);
+			return;
+		},
 	});
@@ -38,0 +48,0 @@

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

129817

decreased by-1.91%

Number of package files

38

decreased by-13.64%

Lines of code

1830

decreased by-1.67%

No dependency changes