2

I started working to make some of my lightning components compliant with LockerService announced recently by Salesforce.

One of my Lightning Components (already in production for some orgs) rely on the use of eval() and new Function(). I use them to interpret a string expression. So basically I'm evaluating expression like: eval("'something' == 'something else'"); and I expect to receive false.

When I'm running analysis tool I'm getting following errors:

no-new-func       The Function constructor is eval    
no-eval           eval can be harmful

And here is the question. Would there be any way to get around it without writting whole expression evaluator? Or it means that starting Winter 17' - these components will stop working?

Improve this question

2 Answers 2

Reset to default
3

(changed) All forms of unsafe-eval, including setTimeout(string), are not allowed by our security requirements, but beginning with Summer ’18, we provide a safe version of eval() and Function(). See the Summer ’18 Release Notes

(changed) All form of unsafe-inline are blocked by content security policy (CSP) which is by default. If you have an older org, we recommend turning the preference "Stricter CSP" on. See the Critical Update for Stricter CSP Restrictions.

Where are the dynamic parts of your expressions coming from? What are the operators and functions you need to support? I am thinking out loud here but it's very possible you could just leverage Lightning's built in expression engine that is already LS compliant.

Improve this answer
3
  • When you mean unsafe eval() - is there any way to do save eval()? In most cases it's purely string eval. Component logic is building string to be evaluated. Most common scenarios are: 'string' == 'other string' or if (condition) { 'something'} else { 'sth else' }
    – Maciek Simm
    Jun 13, 2016 at 15:19
  • Regarding expressions - my understanding is that expressions can be used only in .cmp and .app files - within {! ... } tags. I'm looking for a solution to evaluate expression within controller.js or helper.js files.
    – Maciek Simm
    Jun 13, 2016 at 15:33
  • All forms of eval() are not allowed in LC - this and unsafe-inline's are the basis for all XSS attacks that we need to eliminate. The term "unsafe-eval" comes from Content Security Policy and is a bit misleading since I see how it implies that there might be a safe alternative. Expressions can be created dynamically but might not be the best routwe if you need that much expressiveness. An alternative would be to leverage a small, hidden VF page via an iframe and postMessage(). This is similar to what Lightning framework does itself for the same reasons.
    – Doug Chasman
    Jun 14, 2016 at 12:43
1

As of Summer '18, LC allows safe eval() and safe Function() due to popular demand.

See the release notes here: https://releasenotes.docs.salesforce.com/en-us/summer18/release-notes/rn_lc_locker_service.htm

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .