You're Invited:Meet the Socket Team at BlackHat and DEF CON in Las Vegas, Aug 4-6.RSVP
Socket
Book a DemoInstallSign in
Socket

loophole

Package Overview
Dependencies
Maintainers
5
Versions
6
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

loophole

A hack to enable use of libraries that depend on a basic form of eval in Atom

1.1.0
latest
Source
npmnpm
Version published
Maintainers
5
Created
Source

Eval Loophole Build Status

This is a hack to enable third-party libraries that depend on a limited subset of eval semantics to work in Atom with a content security policy that forbids calls to eval.

{allowUnsafeEval, allowUnsafeNewFunction} = require 'loophole'

allowUnsafeEval ->
  crazyLibrary.exploitLoophole() # allows `eval(...)`

allowUnsafeNewFunction ->
  crazyLibrary.exploitLoophole() # allows `new Function(...)`

You can also use the exported Function constructor directly:

{Function} = require 'loophole'
f = new Function("return 1 + 1;")

How?

allowUnsafeEval replaces eval with a call to vm.runInThisContext, which won't perfectly emulate eval but is good enough in certain circumstances, like compiling PEG.js grammars.

allowUnsafeNewFunction temporarily replaces global.Function with loophole.Function, which passes the source of the desired function to vm.runInThisContext.

Why?

If there's a loophole, why even enable CSP? It still prevents developers from accidentally invoking eval with legacy libraries. For example, did you know that jQuery runs eval when you pass it content with script tags? If you want eval, you'll need to explicitly ask for it.

FAQs

Package last updated on 29 Jul 2015

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts