Opened 9 years ago

Closed 7 years ago

Last modified 7 years ago

#13381 closed Task (fixed)

Remove eval function calls

Reported by: RobertDiebels Owned by: Tomasz Jakut
Priority: Must have (possibly next milestone) Milestone: CKEditor 4.7.0
Component: General Version: 3.0
Keywords: Cc:


Hi everyone,

I have an "issue" I would like to report. While it is not really a bug it is one in terms of cleanliness of code. We have strict policies at our company concerning the usages of "eval()" and similar methods/prototypes.

We would very much like to use your product/library in our products however we cannot do so as in your code there are usages of things like "new Function()". Is there anything on your roadmap to remove such constructs?

Change History (6)

comment:1 Changed 9 years ago by Piotrek Koszuliński

Keywords: eval functions removed
Status: newconfirmed

AFAICS "Function()" is used in a single place only - in core/template.js and we do not use eval at all.

We don't have any plans regarding changing this code. If you would like to handle this ticket please read!/guide/dev_contributing_code

PS. Info for others – I confirm this ticket because any kind of code evaluation is considered insecure. The template.js case is relatively very safe, but in environments which disallow using function constructor at all this is a problem.

comment:2 Changed 7 years ago by Marek Lewandowski

Milestone: CKEditor 4.7.0
Priority: NormalMust have (possibly next milestone)

It's about time to take this one 🎉.

There's a PR#332 for this, originating from PR#254.

comment:3 Changed 7 years ago by Tomasz Jakut

Owner: set to Tomasz Jakut
Status: confirmedassigned

comment:4 Changed 7 years ago by Tomasz Jakut

Status: assignedreview

Proposed fix is in PR #332.

comment:5 Changed 7 years ago by kkrzton

Resolution: fixed
Status: reviewclosed

Fixed with 3ee6035.

comment:6 Changed 7 years ago by Marek Lewandowski

Summary: Usage of eval prototypesRemove eval function calls
Note: See TracTickets for help on using tickets.
© 2003 – 2022, CKSource sp. z o.o. sp.k. All rights reserved. | Terms of use | Privacy policy