Replace deprecated and fragile APIs (eval, document.write) in demos

[dataCenter430]

Description

eval() usage (demos / Block Factory)

eval() is used in several demo and Block Factory files. If block definitions or generated code can be influenced by untrusted input (e.g. exported blocks, loaded workspace), this can lead to code injection.

Location	Line	Usage
packages/blockly/demos/blockfactory/block_exporter_tools.js	141	eval(blockDefs) on generated block definitions
packages/blockly/demos/blockfactory/factory_utils.js	855	eval(blockDefsString) in addBlockDefinitionsFromBlockTypes
packages/blockly/demos/blockfactory/factory.js	220	eval(code) for JavaScript block definitions (errors only logged, not shown in UI)
packages/blockly/demos/code/code.js	601	eval(code) for running generated JS (try/catch + alert)
Risk: High if input is ever user/attacker-controlled; medium if demos only run trusted content.

---

document.write (Code demo)

• File: packages/blockly/demos/code/code.js (lines 621–624)
• Usage: document.write for script loading.
• Issues:
  • Can break the page if run after load.
  • Generally deprecated and can enable script injection if the path or Code.LANG is influenced by input.
• Severity: Medium in a demo context.

---

[dataCenter430]

hey, @maribethb I hope you're doing well.
I'd love to contribute to blockly actively, since I discovered this repo as a contributor.
please assign this to me, if needed.

[maribethb]

Hi @dataCenter430 thanks for opening the issue but this isn't something we plan to address. Our use of eval is for demo purposes only and we don't plan on complicating the demo to avoid it. Feel free to browse the help wanted tagged issues if you'd like to find something to contribute!