Skip to content

Use of direct eval function is strongly discouraged in lottie_canvas.module.js #381

@mvala

Description

@mvala

We are getting following output while building our library

[EVAL] Warning: Use of direct `eval` function is strongly discouraged as it poses security risks and may cause issues with minification.
       ╭─[ node_modules/jsroot/node_modules/three/examples/jsm/libs/lottie_canvas.module.js:13973:31 ]
       │
 13973 │     var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]; // eslint-disable-line no-eval
       │                               ──┬─  
       │                                 ╰─── Use of direct `eval` here.
       │ 
       │ Help: Consider using indirect eval. For more information, check the documentation: https://rolldown.rs/guide/troubleshooting#avoiding-direct-eval
───────╯

[plugin builtin:reporter] 
(!) Some chunks are larger than 500 kB after minification. Consider:
- Using dynamic import() to code-split the application
- Use build.rollupOptions.output.manualChunks to improve chunking: https://rollupjs.org/configuration-options/#output-manualchunks
- Adjust chunk size limit for this warning via build.chunkSizeWarningLimit.
✓ built in 2.17s

When one would like to use it in let's say secure environment like https://cockpit-project.org/ is doing we via plugin https://github.com/cockpit-project/starter-kit. We get following error

You cannot modify Cockpit's host CSP to allow 'unsafe-eval'. 
Your solution must come from ensuring your application and 
its build process do not use eval() or similar functions. 
The devtool option in Webpack is almost certainly the first place to look.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions