BlockEditor: Replace eval() with JS-Interpreter

google / blockly-devtools

Tools for Blockly app developers to help build custom blocks.

http://developer.google.com/blockly

Apache License 2.0

60 stars 31 forks source link

BlockEditor: Replace eval() with JS-Interpreter #278

Open AnmAtAnm opened 7 years ago

AnmAtAnm commented 7 years ago

BlockEditor will soon support inputting JavaScript block definitions into the UI via the "Manual JavaScript" setting, but currently the code is eval()ed to realize the preview block. Replace the raw eval() usage with JS-Interpreter to avoid running arbitrary code in the app.

See original bug in https://github.com/google/blockly/issues/1269.