Skip to content
This repository has been archived by the owner on Jul 14, 2024. It is now read-only.

Replace eval with function because of security risks #20

Closed
wants to merge 1 commit into from

Conversation

xlmnxp
Copy link

@xlmnxp xlmnxp commented Jun 5, 2023

I got the following warn in nuxt project

Use of eval in "../../../root/.cache/c12/bitbucket_alwasaet_alwasaet-ui/node_modules/vue3-pdfjs/node_modules/pdfjs-dist/legacy/build/pdf.js" is strongly discouraged as it poses security risks and may cause issues with minification.

I got the following warn in nuxt project
```
Use of eval in "../../../root/.cache/c12/bitbucket_alwasaet_alwasaet-ui/node_modules/vue3-pdfjs/node_modules/pdfjs-dist/legacy/build/pdf.js" is strongly discouraged as it poses security risks and may cause issues with minification.
```
@xlmnxp
Copy link
Author

xlmnxp commented Jun 5, 2023

@Snuffleupagus can you explain why you close the PR?
I think you have reason

@Snuffleupagus
Copy link
Collaborator

Please read https://github.com/mozilla/pdfjs-dist/blob/master/README.md (emphasis mine):

PDF.js is a Portable Document Format (PDF) library that is built with HTML5. Our goal is to create a general-purpose, web standards-based platform for parsing and rendering PDFs.

This is a pre-built version of the PDF.js source code. It is automatically generated by the build scripts.

For usage with older browsers or environments, without support for modern features such as optional chaining, nullish coalescing, and private class fields/methods; please see the legacy/ folder.

See https://github.com/mozilla/pdf.js for learning and contributing.

Furthermore, see also https://github.com/mozilla/pdf.js/blob/184cad3daf657288545fd961ee2be016e12be8f7/src/display/api.js#L2326-L2347

@xlmnxp
Copy link
Author

xlmnxp commented Jun 8, 2023

@Snuffleupagus understood, but is there way to remove that wrong from applications that depends on pdf.js?

our client think the code isn't secure

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants