Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependent package "store" is using eval that is discouraged to use #284

Open
blcham opened this issue Mar 15, 2024 · 1 comment
Open

Dependent package "store" is using eval that is discouraged to use #284

blcham opened this issue Mar 15, 2024 · 1 comment

Comments

@blcham
Copy link
Collaborator

blcham commented Mar 15, 2024

Reported by https://github.com/shellyear.

When using SForms library in record-manager-ui, we encountered the problem when running npm run build:

node_modules/store/pugins/lib/json2.js (493:20) Use of eval in "node_modules/store/plugins/lib/json2.js"
is strongly discouraged as it poses security risk and may cause issues with minification.

The root cause is the "eval" function being used inside node_modules/store/plugins/lib/json2.js. The "store" package is being used inside of @kbss-cvut/s-forms, in one of its dependencies. Eval by itself is not recommended to use in js, due to security issues


Related version of SForms: @kbss-cvut/[email protected]

image


The solution should be to not rely on packages that use eval. Maybe update the dependent package?

@blcham blcham changed the title Package "store" throw warning Dependent package "store" is using eval that is discouraged to use Mar 15, 2024
@blcham
Copy link
Collaborator Author

blcham commented Mar 15, 2024

Note that solution to this issue might be also putting questions depending on yasgui functionality into a separate SForms components project (as it is natural anyway) -- which would also solve #283

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant