common-errors - npm Package Compare versions

Comparing version 0.4.1 to 0.4.2

lib/helpers/class-generator.js

@@ -10,3 +10,5 @@ var util = require('util');
 
-  var Class = eval("var Class = function " + name + "(" + options.args.join(', ') + "){ classConstructor.apply(this, arguments); }; Class;");
+  validateInput(name);
+  validateArrayInput(options.args);
+
   var classConstructor = function classConstructor(){
@@ -21,3 +23,8 @@ Class.super_.call(this);
     this.captureStackTrace();
-  }
+  };
+
+  var classGeneratorFn = new Function('classConstructor',
+    "return function " + name + "(" + options.args.join(', ') + "){ classConstructor.apply(this, arguments); };"
+  );
+  var Class = classGeneratorFn(classConstructor);
   util.inherits(Class, options.extends);
@@ -33,1 +40,9 @@
 }
+
+var validateInput = function validateInput(str){
+  if(typeof str != 'string' || /^[\-\w]$/.test(str)) throw new Error("Unsafe or invalid string '" + (str || '').toString() + "' used to generate Error class.");
+}
+var validateArrayInput = function validateArrayInput(array){
+  if(!array || !Array.isArray(array)) throw new Error("Unsafe or invalid args used to generate Error class.");
+  for(var i = 0; i<array.length; i++) validateInput(array[i]);
+}

package.json

@@ -5,3 +5,3 @@ {
   "description": "Common error classes and utility functions",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "repository": {
@@ -8,0 +8,0 @@ "type": "git",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

41051

1.47%

Lines of code

564

1.99%

No dependency changes