Khan / Khan/live-editor

Eval is not disabled

Open
#679 6 comments 6 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
776
Forks
180
PR merge metrics
No merged PRs in 30d

Description

This repository seems to be dead, but nonetheless writing an issue :

Any useage of `eval` in PJS is met with the warning `eval can be harmful`. Yet a simple fix :

var _eval = eval;
println(_eval('12**2')); // --> logs 144

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the PJS handling for eval and reproduce the reported indirect-eval snippet. Confirm how direct eval is currently warned, then define done as preventing the indirect form from bypassing the intended restriction while preserving the expected warning behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.