November Happy Hour will be moved to Thursday December 5th.
AI OnAI Off
November Happy Hour will be moved to Thursday December 5th.
I think this is safe enough already?
// Those eval statements are safe because js strings come from the formModel
// and formModel comes directly from serverside (not any script can intercept)
Additionally since the source is known to you then it is no problem in doing that. It is a plain string and eval just executes them as is. If you are unsure of source then you might need to store it differently -
Function(formModel.jQuery)()
And keep in mind this post as well -
https://stackoverflow.com/a/4599946/1982631
eval() evaluates a string as a JavaScript expression within the current execution scope and can access local variables.
new Function() parses the JavaScript code stored in a string into a function object, which can then be called. It cannot access local variables because the code runs in a separate scope.
Hi,
I've managed to deliver a EpiForm with with help of documentations (https://docs.developers.optimizely.com/content-cloud/v1.5.0-content-delivery-api/docs/content-delivery-api-and-optimizely-forms#formrenderingservicejs), Especially FormRendingService.js.
Actully the FomRenderingService.js using eval() function to inject JS files in to the window, now I'm getting security warnings from my greater team about this eval() function usage, because its leeds to security vialations it seems.
Now I'm looking for an alternative way to inject javascript from Form Content Delivery API.
Anyone have suggestions to overcome this issue?
Thank you,
Hari