Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

noUse of eval is strongly discouraged #36

Open
wilberforce opened this issue Apr 23, 2022 · 3 comments
Open

noUse of eval is strongly discouraged #36

wilberforce opened this issue Apr 23, 2022 · 3 comments

Comments

@wilberforce
Copy link

Thanks for a great package!

On build I get noUse of eval is strongly discouraged, as it poses security risks and may cause issues with minification

const yMin = eval(`
let dataMin = ${dataMin || 0}
${domain[0]}
`)
const yMax = eval(`
let dataMax = ${dataMax || 0}
${domain[1]}

Can't this be re-written without eval ?

@ghalex
Copy link
Owner

ghalex commented Apr 26, 2022

Hi @wilberforce,

The idea of eval here is to allow the ability to write dynamic domain like:

['dataMin * 2', 'dataMax * 4 + 100']

I don't see how this can be done without eval but if you have any ideas they are welcome.

Thanks,
Alexandru

@wilberforce
Copy link
Author

Hi, untested - however this will do it I think!

const [dataMin, dataMax] = extent(Array.from(new Set(values.concat([valueMin || 0, valueMax || 0]))))
  function yMin() { return `${domain[0]}` }
  function yMax () { return `${domain[1]}` }
  return [yMin(), yMax()]

@psykora
Copy link

psykora commented Jan 2, 2023

Hi Alexandru (@ghalex),

how about allowing functions (DataExtent) => AxisRange directly instead of string for evaluation?

i.e. replacing this ['dataMin * 2', 'dataMax * 4 + 100']
with this ([dataMin, dataMax]) => [dataMin*2, dataMax*4 + 100]

if user supplies [constant, constant] instead of functions, it will work as before.

The complete working proposal is here is here:
psykora@880cbcf

It is a breaking change though.

Thanks, Peter.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants