Can I use `eval` or similar functions?

[kerrishotts]

No. eval and similar methods of executing code are disabled. This is for a variety of reasons, including security-related concerns.

This doesn’t, however, prevent you from running arbitrary code – it just means you have to get inventive. Before considering this path, however, be sure to consider whether or not you really need to run arbitrary code, as there may be considerable risks to doing so.

Some options:

• Use a JavaScript-in-JavaScript interpreter. Some possible options:
  • https://www.npmjs.com/package/sandboxr
  • https://www.npmjs.com/package/sval
  • https://github.com/NeilFraser/JS-Interpreter
  • https://www.npmjs.com/package/@axetroy/vm
• Use a mathematical expression evaluator. Some possible options:
  • https://www.npmjs.com/package/math-expression-evaluator
• Build your own scripting language!
  • This assumes you like building parsers, lexers, etc., but for those who like doing so, the option is available!

[koppasoft]

From my test and understanding, a JS interpreter like https://github.com/NeilFraser/JS-Interpreter (that you mentioned) resorts to the Function type, which is also forbidden in the Adobe XD plugin runtime.

Did I miss something? Is it really possible to interpret JavaScript code within JavaScript without using the eval or Function?

[kerrishotts]

sval works for sure; I’ve used it myself.

[eklem]

Is there a way to webpack things to avoid eval?
Will something like this work?
const eval = require "sval";

[eklem]

Ah, see that it’s a bit more intricate, but I’ll have a go. I quess I need to require sval, then use the interpreter.import to include the eval-fested libraries, and then interpreter.run for exporting them.

[kerrishotts]

You can configure webpack to avoid creating code that relies on eval – this is generally dependent upon your devtool setting. An empty value should stop webpack from generating any such code, although there are other options that work here as well. For more info, see https://webpack.js.org/configuration/devtool/ (I’d avoid any settings with eval in the name)

Of course, if your own code (or libraries you use) depends on eval, that’s a different story from the above. My guess is that you could webpack a separate bundle, targeting ES5, run it through sval and then use that result. I’ve had thoughts of trying something similar for the HTML Playground to add JS and React support, but haven’t got there yet.

[eklem]

Thanks, @kerrishotts. My dependencies seems to depend on eval, so I need to take that route. I’ll post a little about the results if any success