New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Removing eval (function constructor) #5863

Open

Juraj-Masiar wants to merge 1 commit into lodash:main from Juraj-Masiar:patch-1

Juraj-Masiar commented May 8, 2024

Many linters complains about evals, so removing the legacy Function('return this')() will greatly help!

What about compatibility?
The existing globalThis has a great support for 5 years now, including Node 12, Deno 1.0, Safari 12.1, Chrome 71, Firefox 65: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis#browser_compatibility

Prior to globalThis, the only reliable cross-platform way to get the global object for an environment was Function('return this')(). However, this causes CSP violations in some settings, so authors would use a piecewise definition like this (slightly adapted from the original core-js source):

This issue has been reported many times in this and many other repositories:
https://github.com/lodash/lodash/issues?q=eval
most recent: #5862


          Removing eval (function constructor)

382bb95

Many linters complains about evals, so removing the legacy `Function('return this')()` will greatly help!

**What about compatibility?**
The existing `globalThis` has a great support for 5 years now, including Node 12, Deno 1.0, Safari 12.1, Chrome 71, Firefox 65:  
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis#browser_compatibility

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment