fix: CodeQL SM04509 issue (#4671)

* Remove eval and eslint suppressions * Ensure path is converted to string
microsoft · Jun 4, 2024 · 67a5708 · 67a5708
1 parent 37c7b6a
commit 67a5708
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/libraries/botbuilder-lg/src/evaluationOptions.ts b/libraries/botbuilder-lg/src/evaluationOptions.ts
@@ -87,10 +87,7 @@ export class EvaluationOptions {
                                     this.strictMode = true;
                                 }
                             } else if (key.toLowerCase() === this.replaceNullKey.toLowerCase()) {
-                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                this.nullSubstitution = (path) =>
-                                    // eslint-disable-next-line security/detect-eval-with-expression
-                                    eval('`' + value.replace(this.nullKeyReplaceStrRegex, '${path}') + '`'); // CodeQL [SM04509] Eval on content that is from a trusted source
+                                this.nullSubstitution = (path) => value.replace(this.nullKeyReplaceStrRegex, `${path}`);
                             } else if (key.toLowerCase() === this.lineBreakKey.toLowerCase()) {
                                 this.LineBreakStyle =
                                     value.toLowerCase() === LGLineBreakStyle.Markdown.toString().toLowerCase()