opencomponents / oc

OpenComponents, serverless in the front-end world for painless micro-frontends delivery
https://opencomponents.github.io/
MIT License
1.43k stars 122 forks source link

ban eval from ocs #1357

Closed ricardo-devis-agullo closed 8 months ago

ricardo-devis-agullo commented 8 months ago

There was a security exploit where components could use eval to escape their context and execute code on the registry. This is because by default, code in VM will have access to eval even if it's not explicitly passed. This explicitly sets it as undefined so is not possible to do it anymore.