emscripten-core / emscripten-core/emscripten

Consider using an indirect eval for DYNAMIC_EXECUTION

Open
#23,464 3 comments 0 reactions 1 assignee Claimed by @brendandahl View on GitHub
embind
Dominant language
C++
Stars
27.6k
Forks
3.6k
Avg merge
1d 1h
Merged PRs (30d)
105

Description

The supporting JS code for `DYNAMIC_EXECUTION` currently uses a direct `eval`, which gives the eval-ed code access to names in the scope it is called from, as bundlers (Rollup, esbuild, and so on) cannot analyze such accesses, they emit a warning and might have to resort to performing less tree shaking.

Using an indirect `eval` (`(0, eval)`) avoids this, and if possible, should be preferred.

Of course, using `eval` at all is a problem with a CSP, though I think it might be possible to workaround that by injecting dynamic script tags with a nonce instead of using eval to allow running without `unsafe-eval`. But that's another issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.