vue - npm Package Compare versions

Comparing version 0.12.11 to 0.12.12-csp

package.json

 {
   "name": "vue",
-  "version": "0.12.11",
+  "version": "0.12.12-csp",
   "author": "Evan You <[e-mail]>",
@@ -48,2 +48,3 @@ "license": "MIT",
     "karma-sauce-launcher": "^0.2.14",
+    "notevil": "^1.0.0",
     "phantomjs": "^1.9.17",
@@ -50,0 +51,0 @@ "semver": "^5.0.1",

src/api/child.js

@@ -26,11 +26,6 @@ var _ = require('../util')
     if (!ChildVue) {
-      var optionName = BaseCtor.options.name
-      var className = optionName
-        ? _.classify(optionName)
-        : 'VueComponent'
-      ChildVue = new Function(
-        'return function ' + className + ' (options) {' +
-        'this.constructor = ' + className + ';' +
-        'this._init(options) }'
-      )()
+      ChildVue = function VueComponent (options) {
+        this.constructor = ChildVue
+        this._init(options)
+      }
       ChildVue.options = BaseCtor.options
@@ -37,0 +32,0 @@ ChildVue.linker = BaseCtor.linker

src/api/global.js

@@ -39,7 +39,5 @@ var _ = require('../util')
   var Super = this
-  var Sub = createClass(
-    extendOptions.name ||
-    Super.options.name ||
-    'VueComponent'
-  )
+  var Sub = function VueComponent (options) {
+    _.Vue.call(this, options)
+  }
   Sub.prototype = Object.create(Super.prototype)
@@ -64,18 +62,2 @@ Sub.prototype.constructor = Sub
 /**
- * A function that returns a sub-class constructor with the
- * given name. This gives us much nicer output when
- * logging instances in the console.
- *
- * @param {String} name
- * @return {Function}
- */
-
-function createClass (name) {
-  return new Function(
-    'return function ' + _.classify(name) +
-    ' (options) { this._init(options) }'
-  )()
-}
-
-/**
  * Plugin system
@@ -82,0 +64,0 @@ *

src/directives/model/checkbox.js

@@ -0,1 +1,3 @@
+var _ = require('../../util')
+
 module.exports = {
@@ -10,7 +12,7 @@
     this._matchValue = function (value) {
-      var trueValue = true
       if (trueExp !== null) {
-        trueValue = self.vm.$eval(trueExp)
+        return _.looseEqual(value, self.vm.$eval(trueExp))
+      } else {
+        return !!value
       }
-      return trueValue === value
     }
@@ -17,0 +19,0 @@

src/directives/model/radio.js

@@ -31,6 +31,4 @@ var _ = require('../../util')
   update: function (value) {
-    /* eslint-disable eqeqeq */
-    this.el.checked = value == this.getValue()
-    /* eslint-enable eqeqeq */
+    this.el.checked = _.looseEqual(value, this.getValue())
   }
 }

src/directives/model/select.js

@@ -68,3 +68,3 @@ var _ = require('../../util')
         ? indexOf(value, val) > -1
-        : equals(value, val)
+        : _.looseEqual(value, val)
       /* eslint-enable eqeqeq */
@@ -226,3 +226,3 @@ }
   while (i--) {
-    if (equals(arr[i], val)) {
+    if (_.looseEqual(arr[i], val)) {
       return i
@@ -233,13 +233,1 @@ }
 }
-
-/**
- * Check if two values are loosely equal. If two objects
- * have the same shape, they are considered equal too:
- *   equals({a: 1}, {a: 1}) => true
- */
-
-function equals (a, b) {
-  /* eslint-disable eqeqeq */
-  return a == b || JSON.stringify(a) == JSON.stringify(b)
-  /* eslint-enable eqeqeq */
-}

src/parsers/expression.js

 var _ = require('../util')
 var Path = require('./path')
 var Cache = require('../cache')
+var notevil = require('../../vendor/notevil')
 var expressionCache = new Cache(1000)
@@ -176,3 +177,9 @@
   try {
-    return new Function('scope', 'return ' + body + ';')
+    var fn = notevil.Function(
+      'scope', 'Math',
+      'return ' + body + ';'
+    )
+    return function (scope) {
+      return fn.call(this, scope, Math)
+    }
   } catch (e) {
@@ -202,3 +209,11 @@ process.env.NODE_ENV !== 'production' && _.warn(
   try {
-    return new Function('scope', 'value', body + '=value;')
+    var fn = notevil.Function(
+      'scope', 'value', 'Math',
+      body + ' = value;'
+    )
+    return function (scope, value) {
+      try {
+        fn.call(this, scope, value, Math)
+      } catch (e) {}
+    }
   } catch (e) {
@@ -205,0 +220,0 @@ process.env.NODE_ENV !== 'production' && _.warn(

src/parsers/path.js

 var _ = require('../util')
 var Cache = require('../cache')
 var pathCache = new Cache(1000)
-var identRE = exports.identRE = /^[$_a-zA-Z]+[\w$]*$/
+exports.identRE = /^[$_a-zA-Z]+[\w$]*$/
 
@@ -233,21 +233,2 @@ // actions
 /**
- * Format a accessor segment based on its type.
- *
- * @param {String} key
- * @return {Boolean}
- */
-
-function formatAccessor (key) {
-  if (identRE.test(key)) { // identifier
-    return '.' + key
-  } else if (+key === key >>> 0) { // bracket index
-    return '[' + key + ']'
-  } else if (key.charAt(0) === '*') {
-    return '[o' + formatAccessor(key.slice(1)) + ']'
-  } else { // bracket string
-    return '["' + key.replace(/"/g, '\\"') + '"]'
-  }
-}
-
-/**
  * Compiles a getter function with a fixed path.
@@ -261,4 +242,18 @@ * The fixed path getter supresses errors.
 exports.compileGetter = function (path) {
-  var body = 'return o' + path.map(formatAccessor).join('')
-  return new Function('o', body)
+  return function get (obj) {
+    var original = obj
+    var segment
+    for (var i = 0, l = path.length; i < l; i++) {
+      segment = path[i]
+      if (segment.charAt(0) === '*') {
+        segment = original[segment.slice(1)]
+      }
+      obj = obj[segment]
+      if (i === l - 1) {
+        return obj
+      } else if (!_.isObject(obj)) {
+        return
+      }
+    }
+  }
 }
@@ -265,0 +260,0 @@

src/util/lang.js

@@ -290,1 +290,20 @@ /**
 }
+
+/**
+ * Check if two values are loosely equal - that is,
+ * if they are plain objects, do they have the same shape?
+ *
+ * @param {*} a
+ * @param {*} b
+ * @return {Boolean}
+ */
+
+exports.looseEqual = function (a, b) {
+  /* eslint-disable eqeqeq */
+  return a == b || (
+    exports.isObject(a) && exports.isObject(b)
+      ? JSON.stringify(a) === JSON.stringify(b)
+      : false
+  )
+  /* eslint-enable eqeqeq */
+}

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

893045

increased by65.75%

Number of package files

73

increased by1.39%

Lines of code

25976

increased by45.35%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dev dependency count

22

increased by4.76%

No dependency changes