From: Florian Müllner <fmuellner@gnome.org>
Date: Fri, 30 Nov 2018 15:57:47 +0000 (+0100)
Subject: lookingGlass: Stop using eval()
X-Git-Tag: archive/raspbian/50.5-1+rpi1~1^2~897^2^2~146
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=467b7c1bcacebdcb90ba916651b5bcc897865e20;p=gnome-shell.git

lookingGlass: Stop using eval()

Its use is not only strongly discouraged[0], we also rely on it injecting
variables into the global scope to get command-line-like behavior. That
behavior is incompatible with strict mode[1], and in extension with ES6
classes (which imply strict mode).

So to prepare for porting to ES6 classes, replace it with a somewhat less
evil construct that is compatible with strict mode.

[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#Do_not_ever_use_eval!
[1]
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode#Simplifying_variable_uses

https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/350
---

diff --git a/js/ui/lookingGlass.js b/js/ui/lookingGlass.js
index 34c60cb65..186b53ce3 100644
--- a/js/ui/lookingGlass.js
+++ b/js/ui/lookingGlass.js
@@ -1003,11 +1003,14 @@ var LookingGlass = new Lang.Class({
     _evaluate(command) {
         this._history.addItem(command);
 
-        let fullCmd = commandHeader + command;
+        let lines = command.split(';');
+        lines.push(`return ${lines.pop()}`);
+
+        let fullCmd = commandHeader + lines.join(';');
 
         let resultObj;
         try {
-            resultObj = eval(fullCmd);
+            resultObj = Function(fullCmd)();
         } catch (e) {
             resultObj = '<exception ' + e + '>';
         }