dy/prepr

preprocessor is very injectable

AndrewRayCode opened this issue · 1 comments

AndrewRayCode commented 
#if console.log(1)
#endif

This library is not currently safe to use in any browser nor node environment where user input is allowed.

dy commented

@AndrewRayCode
In 66cf524 replaced eval with vm. Now that is safer.
If you know unsafe cases, I may integrate math-eval instead.

  • 👍1