Consider full removal of eval
support
#1348
Labels
enhancement
New feature or request
Security
Security Related
tech debt
Placeholder for work that is invisible to the user
Why?
Using
eval
for most validation/search of large schemas is usually a pretty good idea for performance. However, there is some obvious risk allowingeval
to be used in your application. We might want to look at allowing noeval
at allWeb Assembly
This will usually throw errors. However, there is a setting just to allow WASM this privilege.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_webassembly_execution
MUI
Uses
eval
for data grid filtering. This is easy to disable by puttingdisableEval
on the data grids. Would need to look into performance impactmui/mui-x#11465
AJV
This would be a huge change in approach to the UI. We would need to either switch off AJV
ajv-validator/ajv#2285
Why haven't we yet?
This makes our lives MUCH MUCH MUCH easier. Replacing AJV is no small task. That would mean potentially having to replace JSONForms and that is a big deal. If we "pre comiple" it then we would need to have a build like marketing site and listen to changes to the connectors table. This would also be a pain to maintain.
Also, using
eval
allows for the filter that MUI does to be faster and easier.Some documentation also says that
eval
should be okay while within a file that ishash
ed ornonce
d but I am not entirely sure if that is true.The text was updated successfully, but these errors were encountered: