RE: Proposal: safeEval

2018-06-30 Thread doodad-js Admin
But I doubt it can be full proof without runtime’s help. I found a way: AST filtering with rewriting. So that “obj[key]” will get rewritten to “safeEval.get(obj, key)”. That is now part of my TODO list for “@doodad-js/safeeval”. For the moment, I block the dynamic property accessor operator

Re: Proposal: safeEval

2018-06-20 Thread Mike Samuel
How would this compare to https://github.com/tc39/proposal-frozen-realms ? I'm not sure how to run @doodad-js/safeeval in node since require doesn't provide obvious access to safeeval, but the code seems to do AST filtering. What does it do for inputs like safeEval('

RE: Proposal: safeEval

2018-06-19 Thread doodad-js Admin
Thanks, There is an option to allow/disallow some aspects of the language, and you can provide the local variables you want to the expression. Claude From: Jordan Harband Sent: Tuesday, June 19, 2018 10:59 PM To: doodad-js Admin Cc: es-discuss Subject: Re: Proposal: safeEval What

Re: Proposal: safeEval

2018-06-19 Thread Jordan Harband
What value does this add, when you can already do `function safeEval(...args) { return Function(...args)(); }`, or similar? On Tue, Jun 19, 2018 at 7:29 PM, doodad-js Admin wrote: > Hi, > > > > I take a chance to valorize “eval” again by proposing “safeEval”. > > > > function