From: Florian Müllner <fmuellner@gnome.org>
Date: Wed, 12 Jul 2023 23:52:06 +0000 (+0200)
Subject: jsParse: Replace eval()
X-Git-Tag: archive/raspbian/50.5-1+rpi1~1^2~337^2~1^2~150
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=13e20e47bf265e838c267154dc731ba962e4a9fe;p=gnome-shell.git

jsParse: Replace eval()

The evil() function is considered eval, replace it like we
already did in looking glass.

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2842>
---

diff --git a/js/misc/jsParse.js b/js/misc/jsParse.js
index 97a6ce470..18ce70398 100644
--- a/js/misc/jsParse.js
+++ b/js/misc/jsParse.js
@@ -197,7 +197,9 @@ function getPropertyNamesFromExpression(expr, commandHeader = '') {
     let obj = {};
     if (!isUnsafeExpression(expr)) {
         try {
-            obj = eval(commandHeader + expr);
+            const lines = expr.split(';');
+            lines.push(`return ${lines.pop()}`);
+            obj = Function(commandHeader + lines.join(';'))();
         } catch (e) {
             return [];
         }