Use of eval is strongly discouraged #112

New issue

Open

opened 2020-08-24 22:43:05 +00:00 by autoferrit · 5 comments

autoferrit commented

2020-08-24 22:43:05 +00:00

(Migrated from github.com)

I installed gray-matter to use with svelte/sapper, and once I did, I started getting this error message in my console.

> sapper dev

✔ client (1.0s)
✔ service worker (1.7s)
• server
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
41:         str = '(function() {\nreturn ' + str.trim() + ';\n}());';
42:       }
43:       return eval(str) || {};
                 ^
44:     } catch (err) {
45:       if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) {
> Listening on http://localhost:3000

The app still seems to work. But is there a way I can silence this? Or is there a way to do the same thing without using eval? As using it definitely can be a security risk.

I installed gray-matter to use with svelte/sapper, and once I did, I started getting this error message in my console. ```bash > sapper dev ✔ client (1.0s) ✔ service worker (1.7s) • server Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification 41: str = '(function() {\nreturn ' + str.trim() + ';\n}());'; 42: } 43: return eval(str) || {}; ^ 44: } catch (err) { 45: if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) { > Listening on http://localhost:3000 ``` The app still seems to work. But is there a way I can silence this? Or is there a way to do the same thing without using eval? As using it definitely can be a security risk.

👍 2

robertmassaioli commented

2020-08-24 23:04:32 +00:00

(Migrated from github.com)

The only way that a security issue could arise is if:

You used the javascript engine. AND
You let people using your service provide that input into gray-matter.

I'm not sure if there is another way to do what that engine does without eval since the purpose of the engine seems to be "evaluate javascript". I'll let @jonschlinkert comment further.

The only way that a security issue could arise is if: 1. You used the `javascript` engine. AND 1. You let people using your service provide that input into gray-matter. I'm not sure if there is another way to do what that engine does without eval since the purpose of the engine seems to be "evaluate javascript". I'll let @jonschlinkert comment further.

👍 3

jonschlinkert commented

2020-08-25 02:58:06 +00:00

(Migrated from github.com)

@robertmassaioli is correct. This is an opt-in feature. I don’t see how anyone would be able to abuse this unless you intentionally let them.

ghost commented

2020-08-25 20:59:28 +00:00

(Migrated from github.com)

@autoferrit, I end up using Front-matter.

@autoferrit, I end up using [Front-matter](https://www.npmjs.com/package/front-matter).

👍 3

autoferrit commented

2020-08-27 04:20:52 +00:00

(Migrated from github.com)

Yea, that makes sense. Is there a configuration to be able to hide this?

👍 4

mrleblanc101 commented

2026-08-20 20:56:01 +00:00

(Migrated from github.com)

I get this warning when building my app now.

node: 22.21.0 pnpm: 8.15.5

I get this warning when building my app now. node: 22.21.0 pnpm: 8.15.5 <img width="1246" height="173" alt="Image" src="https://github.com/user-attachments/assets/2a01c869-395c-4d8c-8ea7-74c85af56001" />