emscripten-core / emscripten-core/emscripten
Consider using an indirect eval for DYNAMIC_EXECUTION
- Dominant language
- C++
- Stars
- 27.6k
- Forks
- 3.6k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 105
Description
The supporting JS code for `DYNAMIC_EXECUTION` currently uses a direct `eval`, which gives the eval-ed code access to names in the scope it is called from, as bundlers (Rollup, esbuild, and so on) cannot analyze such accesses, they emit a warning and might have to resort to performing less tree shaking.
Using an indirect `eval` (`(0, eval)`) avoids this, and if possible, should be preferred.
Of course, using `eval` at all is a problem with a CSP, though I think it might be possible to workaround that by injecting dynamic script tags with a nonce instead of using eval to allow running without `unsafe-eval`. But that's another issue.
Contributor guide
Assessment
This issue has not been assessed yet.