Opened 4 years ago

Closed 21 months ago

Last modified 20 months ago

#13381 closed Task (fixed)

Remove eval function calls

Reported by: RobertDiebels Owned by: Tomasz Jakut
Priority: Must have (possibly next milestone) Milestone: CKEditor 4.7.0
Component: General Version: 3.0
Keywords: Cc:

Description

Hi everyone,

I have an "issue" I would like to report. While it is not really a bug it is one in terms of cleanliness of code. We have strict policies at our company concerning the usages of "eval()" and similar methods/prototypes.

We would very much like to use your product/library in our products however we cannot do so as in your code there are usages of things like "new Function()". Is there anything on your roadmap to remove such constructs?

Change History (6)

comment:1 Changed 4 years ago by Piotrek Koszuliński

Keywords: eval functions removed
Status: newconfirmed
Version: 4.4.73.0

AFAICS "Function()" is used in a single place only - in core/template.js and we do not use eval at all.

We don't have any plans regarding changing this code. If you would like to handle this ticket please read http://docs.ckeditor.com/#!/guide/dev_contributing_code

PS. Info for others – I confirm this ticket because any kind of code evaluation is considered insecure. The template.js case is relatively very safe, but in environments which disallow using function constructor at all this is a problem.

comment:2 Changed 21 months ago by Marek Lewandowski

Milestone: CKEditor 4.7.0
Priority: NormalMust have (possibly next milestone)

It's about time to take this one 🎉.

There's a PR#332 for this, originating from PR#254.

comment:3 Changed 21 months ago by Tomasz Jakut

Owner: set to Tomasz Jakut
Status: confirmedassigned

comment:4 Changed 21 months ago by Tomasz Jakut

Status: assignedreview

Proposed fix is in PR #332.

comment:5 Changed 21 months ago by kkrzton

Resolution: fixed
Status: reviewclosed

Fixed with 3ee6035.

comment:6 Changed 20 months ago by Marek Lewandowski

Summary: Usage of eval prototypesRemove eval function calls
Note: See TracTickets for help on using tickets.
© 2003 – 2017 CKSource – Frederico Knabben. All rights reserved. | Terms of use | Privacy policy