pouchdb-core - npm Package Compare versions

Comparing version 6.0.1 to 6.0.2

lib/index-browser.js

@@ -18,18 +18,22 @@ 'use strict';
 function evalFilter(input) {
-  return scopedEval('return ' + input + ';', {});
+  return scopedEval('"use strict";\nreturn ' + input + ';', {});
 }
 
 function evalView(input) {
-  /* jshint evil:true */
-  return new Function('doc', [
-    'var emitted = false;',
-    'var emit = function (a, b) {',
-    '  emitted = true;',
-    '};',
-    'var view = ' + input + ';',
-    'view(doc);',
-    'if (emitted) {',
-    '  return true;',
-    '}'
-  ].join('\n'));
+  var code = [
+    'return function(doc) {',
+    '  "use strict";',
+    '  var emitted = false;',
+    '  var emit = function (a, b) {',
+    '    emitted = true;',
+    '  };',
+    '  var view = ' + input + ';',
+    '  view(doc);',
+    '  if (emitted) {',
+    '    return true;',
+    '  }',
+    '};'
+  ].join('\n');
+
+  return scopedEval(code, {});
 }
@@ -1384,3 +1388,3 @@
 // managed automatically by set-version.js
-var version = "6.0.1";
+var version = "6.0.2";
 
@@ -1387,0 +1391,0 @@ PouchDB.version = version;

lib/index.js

@@ -14,12 +14,14 @@ 'use strict';
 var pouchdbMerge = require('pouchdb-merge');
-var scopedEval = _interopDefault(require('scope-eval'));
+var vm = _interopDefault(require('vm'));
 var pouchdbErrors = require('pouchdb-errors');
 
 function evalFilter(input) {
-  return scopedEval('return ' + input + ';', {});
+  var code = '(function() {\n"use strict";\nreturn ' + input + '\n})()';
+
+  return vm.runInNewContext(code);
 }
 
 function evalView(input) {
-  /* jshint evil:true */
-  return new Function('doc', [
+  var code = [
+    '"use strict";',
     'var emitted = false;',
@@ -34,3 +36,5 @@ 'var emit = function (a, b) {',
     '}'
-  ].join('\n'));
+  ].join('\n');
+
+  return vm.runInNewContext('(function(doc) {\n' + code + '\n})');
 }
@@ -1385,3 +1389,3 @@
 // managed automatically by set-version.js
-var version = "6.0.1";
+var version = "6.0.2";
 
@@ -1388,0 +1392,0 @@ PouchDB.version = version;

package.json

 {
   "name": "pouchdb-core",
-  "version": "6.0.1",
+  "version": "6.0.2",
   "description": "The core of PouchDB as a standalone package.",
@@ -21,12 +21,14 @@ "main": "./lib/index.js",
     "js-extend": "1.0.1",
-    "pouchdb-collections": "6.0.1",
-    "pouchdb-errors": "6.0.1",
-    "pouchdb-merge": "6.0.1",
-    "pouchdb-promise": "6.0.1",
-    "pouchdb-utils": "6.0.1",
+    "pouchdb-collections": "6.0.2",
+    "pouchdb-errors": "6.0.2",
+    "pouchdb-merge": "6.0.2",
+    "pouchdb-promise": "6.0.2",
+    "pouchdb-utils": "6.0.2",
     "scope-eval": "0.0.3"
   },
   "browser": {
-    "./lib/index.js": "./lib/index-browser.js"
+    "./lib/index.js": "./lib/index-browser.js",
+    "./src/evalFilter.js": "./src/evalFilter-browser.js",
+    "./src/evalView.js": "./src/evalView-browser.js"
   }
 }

src/evalFilter.js

@@ -1,7 +0,9 @@
-import scopedEval from 'scope-eval';
+import vm from 'vm';
 
 function evalFilter(input) {
-  return scopedEval('return ' + input + ';', {});
+  var code = '(function() {\n"use strict";\nreturn ' + input + '\n})()';
+
+  return vm.runInNewContext(code);
 }
 
-export default evalFilter;
+export default evalFilter;

src/evalView.js

@@ -0,4 +1,6 @@
+import vm from 'vm';
+
 function evalView(input) {
-  /* jshint evil:true */
-  return new Function('doc', [
+  var code = [
+    '"use strict";',
     'var emitted = false;',
@@ -13,5 +15,7 @@ 'var emit = function (a, b) {',
     '}'
-  ].join('\n'));
+  ].join('\n');
+
+  return vm.runInNewContext('(function(doc) {\n' + code + '\n})');
 }
 
-export default evalView;
+export default evalView;

src/version.js

 // managed automatically by set-version.js
-export default "6.0.1";
+export default "6.0.2";

New alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

129737

increased by0.78%

Number of package files

17

increased by13.33%

Lines of code

3808

increased by0.9%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Number of low supply chain risk alerts

4

increased by300%

Dependency changes

• + Addedpouchdb-binary-utils@6.0.2(transitive)

• + Addedpouchdb-collections@6.0.2(transitive)

• + Addedpouchdb-errors@6.0.2(transitive)

• + Addedpouchdb-md5@6.0.2(transitive)

• + Addedpouchdb-merge@6.0.2(transitive)

• + Addedpouchdb-promise@6.0.2(transitive)

• + Addedpouchdb-utils@6.0.2(transitive)

• - Removedpouchdb-binary-utils@6.0.1(transitive)

• - Removedpouchdb-collections@6.0.1(transitive)

• - Removedpouchdb-errors@6.0.1(transitive)

• - Removedpouchdb-md5@6.0.1(transitive)

• - Removedpouchdb-merge@6.0.1(transitive)

• - Removedpouchdb-promise@6.0.1(transitive)

• - Removedpouchdb-utils@6.0.1(transitive)

• Updatedpouchdb-collections@6.0.2

• Updatedpouchdb-errors@6.0.2

• Updatedpouchdb-merge@6.0.2

• Updatedpouchdb-promise@6.0.2

• Updatedpouchdb-utils@6.0.2