-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Transform arrow functions without block #108
Conversation
const rewritten = rewriteAst(js) | ||
|
||
// eslint-disable-next-line no-eval | ||
const rewrittenIssue101 = eval(rewritten) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 Code Vulnerability
'eval' with argument of type Identifier (...read more)
The eval
function could execute malicious code if used with non-literal values. The argument provided to the eval
method could be used to execute malicious code. If an attacker manages to control the eval
argument they can execute arbitrary code.
In JavaScript, the eval()
function evaluates or executes an argument if it's a string of JavaScript code. If this argument is influenced by user input or other external sources, it can lead to security vulnerabilities. Specifically, if an attacker can control or manipulate the value of the variable
in eval(variable)
, they can execute arbitrary code.
You should avoid using eval
at all costs, but if you face an advanced use case, use literal values that are under your control or sanitize the input. However, even then it is still recommended to avoid the use of eval
as it has led to security breaches before.
const js = readFileSync(path.join(__dirname, 'resources/issue-101.js')).toString() | ||
|
||
// eslint-disable-next-line no-eval | ||
const issue101 = eval(js) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 Code Vulnerability
'eval' with argument of type Identifier (...read more)
The eval
function could execute malicious code if used with non-literal values. The argument provided to the eval
method could be used to execute malicious code. If an attacker manages to control the eval
argument they can execute arbitrary code.
In JavaScript, the eval()
function evaluates or executes an argument if it's a string of JavaScript code. If this argument is influenced by user input or other external sources, it can lead to security vulnerabilities. Specifically, if an attacker can control or manipulate the value of the variable
in eval(variable)
, they can execute arbitrary code.
You should avoid using eval
at all costs, but if you face an advanced use case, use literal values that are under your control or sanitize the input. However, even then it is still recommended to avoid the use of eval
as it has led to security breaches before.
test/resources/issue-101.js
Outdated
@@ -0,0 +1,112 @@ | |||
'use strict' | |||
|
|||
function names(arg) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For all the methods (why is not failing the linter?)
function names(arg) { | |
function names (arg) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
test/resources
is ignored
But i'm going to rename the methods
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done
What does this PR do?
Transform arrow function bodies with a expression to a body with a block returning the original expression.
Motivation
Fix #101
Additional Notes
Describe how to test your changes
Checklist