globalizejs / globalizejs/globalize

new Func() in globalize dist folder

Open
#943 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
4.8k
Forks
585
PR merge metrics
No merged PRs in 30d

Description

After installing globalize package, in node_modules/globalize/dist/globalize/message.js, we saw new Func() expression. This causes unsafe-eval issue.

Our app has dependency of `relative-time` package, `relative-time` package is internally called `globalize` which is exporting all modules such as `date, currency, message, etc.`. Then, we saw `globalize/dist/globalize/message.js` file contains below code snippet with `new Func()`:

`if (typeof messages == 'string') {
var f = new Function(
'number, plural, select, pluralFuncs, fmt',
'return ' + compileMsg(this, messages));
return f(this.runtime.number, this.runtime.plural, this.runtime.select,
this.runtime.pluralFuncs, this.runtime.fmt);
}`

We are not using message feature at all, so wondering if you can fix this, otherwise please let us know if there is any workaround for it, thanks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.