Socket
Socket
Sign inDemoInstall

loophole

Package Overview
Dependencies
0
Maintainers
1
Versions
6
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

Comparing version 0.3.0 to 0.4.0

18

lib/loophole.js
(function() {
var vm;
var vm,
__slice = [].slice;

@@ -23,5 +24,3 @@ vm = require('vm');

try {
global.Function = function(source) {
return vm.runInThisContext(source);
};
global.Function = exports.Function;
return fn();

@@ -33,2 +32,13 @@ } finally {

exports.Function = function() {
var body, paramList, paramLists, params, _i, _j, _len;
paramLists = 2 <= arguments.length ? __slice.call(arguments, 0, _i = arguments.length - 1) : (_i = 0, []), body = arguments[_i++];
params = [];
for (_j = 0, _len = paramLists.length; _j < _len; _j++) {
paramList = paramLists[_j];
params.push.apply(params, paramList.split(/\s*,\s*/));
}
return vm.runInThisContext("(function(" + (params.join(', ')) + ") {\n " + body + "\n})");
};
}).call(this);
{
"name": "loophole",
"version": "0.3.0",
"version": "0.4.0",
"description": "A hack to enable use of libraries that depend on a basic form of eval in Atom",

@@ -5,0 +5,0 @@ "main": "./lib/loophole.js",

@@ -17,8 +17,19 @@ # Eval Loophole

You can also use the exported `Function` constructor directly:
```coffee
{Function} = require 'loophole'
f = new Function("return 1 + 1;")
```
## How?
It replaces `eval` with a call two `vm.runInThisContext`, which won't perfectly
emulate `eval` but is good enough in certain circumstances, like compiling
[PEG.js][peg-js] grammars.
`allowUnsafeEval` replaces `eval` with a call to `vm.runInThisContext`, which
won't perfectly emulate `eval` but is good enough in certain circumstances, like
compiling [PEG.js][peg-js] grammars.
`allowUnsafeNewFunction` temporarily replaces `global.Function` with
`loophole.Function`, which passes the source of the desired function to
`vm.runInThisContext`.
## Why?

@@ -25,0 +36,0 @@

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc