react-live - npm Package Compare versions

Comparing version 1.4.8 to 1.4.9

lib/utils/test/transpile.test.js

@@ -44,2 +44,10 @@ 'use strict';
     });
+
+    it('should not throw on Object.assign usage', function () {
+      var code = '() => { const props = { b: "b" }; return <div a="a" {...props} /> }';
+
+      expect(function () {
+        (0, _transpile.generateElement)({ code: code });
+      }).not.toThrow();
+    });
   });
@@ -46,0 +54,0 @@

lib/utils/transpile/evalCode.js

@@ -1,4 +0,13 @@
-"use strict";
+'use strict';
 
 exports.__esModule = true;
+
+var _react = require('react');
+
+var _react2 = _interopRequireDefault(_react);
+
+var _transform = require('./transform');
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
 var evalCode = function evalCode(code, scope) {
@@ -9,6 +18,7 @@ var scopeKeys = Object.keys(scope);
   });
-  return new (Function.prototype.bind.apply(Function, [null].concat(scopeKeys, [code])))().apply(undefined, scopeValues);
+  var res = new (Function.prototype.bind.apply(Function, [null].concat(['_poly', 'React'], scopeKeys, [code])))();
+  return res.apply(undefined, [_transform._poly, _react2.default].concat(scopeValues));
 };
 
 exports.default = evalCode;
-module.exports = exports["default"];
+module.exports = exports['default'];

lib/utils/transpile/index.js

@@ -8,6 +8,2 @@ 'use strict';
 
-var _react = require('react');
-
-var _react2 = _interopRequireDefault(_react);
-
 var _transform = require('./transform');
@@ -36,3 +32,3 @@
 
-  return (0, _errorBoundary2.default)((0, _evalCode2.default)('return ' + transformed, _extends({}, scope, { React: _react2.default })), errorCallback);
+  return (0, _errorBoundary2.default)((0, _evalCode2.default)('return ' + transformed, scope), errorCallback);
 };
@@ -54,3 +50,3 @@
 
-  (0, _evalCode2.default)((0, _transform2.default)(code), _extends({}, scope, { render: render, React: _react2.default }));
+  (0, _evalCode2.default)((0, _transform2.default)(code), _extends({}, scope, { render: render }));
 };

lib/utils/transpile/transform.js

 'use strict';
 
 exports.__esModule = true;
+exports._poly = undefined;
 
 var _buble = require('buble/dist/buble.deps');
 
+var _assign = require('core-js/fn/object/assign');
+
+var _assign2 = _interopRequireDefault(_assign);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var _poly = exports._poly = { assign: _assign2.default };
+
 var opts = {
+  objectAssign: '_poly.assign',
   transforms: {
@@ -16,4 +26,2 @@ dangerousForOf: true,
   return (0, _buble.transform)(code, opts).code;
-};
-
-module.exports = exports['default'];
+};

package.json

 {
   "name": "react-live",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "description": "A production-focused playground for live editing React code",
@@ -20,2 +20,3 @@ "main": "lib/index.js",
     "buble": "^0.15.2",
+    "core-js": "^2.4.1",
     "dom-iterator": "^0.3.0",
@@ -22,0 +23,0 @@ "prismjs": "^1.6.0",

src/utils/test/transpile.test.js

@@ -36,2 +36,10 @@ import React from 'react'
     })
+
+    it('should not throw on Object.assign usage', () => {
+      const code = '() => { const props = { b: "b" }; return <div a="a" {...props} /> }'
+
+      expect(() => {
+        generateElement({ code })
+      }).not.toThrow()
+    })
   })
@@ -38,0 +46,0 @@

src/utils/transpile/evalCode.js

@@ -0,7 +1,11 @@
+import React from 'react'
+import { _poly } from './transform'
+
 const evalCode = (code, scope) => {
   const scopeKeys = Object.keys(scope)
   const scopeValues = scopeKeys.map(key => scope[key])
-  return new Function(...scopeKeys, code)(...scopeValues)
+  const res = new Function('_poly', 'React', ...scopeKeys, code)
+  return res(_poly, React, ...scopeValues)
 }
 
 export default evalCode

src/utils/transpile/index.js

@@ -1,2 +0,1 @@
-import React from 'react'
 import transform from './transform'
@@ -18,3 +17,3 @@ import errorBoundary from './errorBoundary'
       `return ${transformed}`,
-      { ...scope, React }
+      scope
     ),
@@ -47,4 +46,4 @@ errorCallback
     transform(code),
-    { ...scope, render, React }
+    { ...scope, render }
   )
 }

src/utils/transpile/transform.js

 import { transform as _transform } from 'buble/dist/buble.deps'
+import assign from 'core-js/fn/object/assign'
 
+export const _poly = { assign }
+
 const opts = {
+  objectAssign: '_poly.assign',
   transforms: {
@@ -5,0 +9,0 @@ dangerousForOf: true,

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1322842

increased by2.14%

Lines of code

27000

increased by2.56%

Worsened metrics

Dependency count

6

increased by20%

Number of medium supply chain risk alerts

7

increased by133.33%

Dependency changes

• + Addedcore-js@^2.4.1

• + Addedcore-js@2.6.12(transitive)