search

soundar24 / roundSlider

roundSlider - A free jQuery plugin
https://roundsliderui.com/
MIT License
264 stars 80 forks source link

Replaced instances of eval with parseFloat #101

Closed aopell closed 4 years ago

aopell commented 4 years ago

I'm using this library in a project where the Content Security Policy is not allowed to contain unsafe-eval, so I investigated why this library needs to call eval and modified the two offending lines to use parseFloat instead, which is safer from a security point of view.

The eval lines were evaluating simple math expressions from a string such as eval("90+360") or eval("45-180"), so I modified it to instead add the first number with a parsed float from the sign and the second number. The previous examples would be evaluated as 90 + parseFloat("+360") and 45 + parseFloat("-180") respectively with the new method.

soundar24 commented 4 years ago

@aopell great.. I will merge the changes and include in the new version.. thanks

soundar24 commented 4 years ago

@aopell these changes was included with the version 1.4.1.

You can check with the below updated source: Production: https://cdn.jsdelivr.net/npm/round-slider@1.4.1/dist/roundslider.min.js Development: https://cdn.jsdelivr.net/npm/round-slider@1.4.1/src/roundslider.js

So you can use this updated version in your project. thanks...

aopell commented 4 years ago

Thank you very much for being so responsive!