OnSuccess/OnFailure properties as part of the rule - Security Issue

There are 2 properties like Onsuccess and Onfailure property which can be a javascript function delegate and it is part of the rule right?

onSuccess: function(event,almanac) { console.log('hello success') },
onFailure : function(event,almanac) { alert('hello failed') }

Is it safe to store this as part of the rule in the database. Because the rule comes from the server to the client this script can be tampered by the hacker and we would end up executing a malicious script. Is that right?

Or Is my understanding wrong? Please confirm

首先追蹤函式屬性 onSuccess 和 onFailure 如何進入規則、從伺服器傳到用戶端並被執行。檢查規則儲存和用戶端執行的進入點，以確定安全邊界；完成的標準是記錄此行為是否安全，以及適用哪些處理指引。

由索引模型根據 Issue 內容生成。