mirror of
https://github.com/atom/atom.git
synced 2026-01-23 05:48:10 -05:00
5e8213d45f
With Node.js baked in, there's no water-tight way to prevent users from evaluating code at runtime, at least with CSP alone. This is because node exposes a 'vm' module that allows scripts to be compiled. There's also `module._compile`, etc. I think a reasonable compromise is to protect users from eval'ing code by accident. This commit adds an atom.allowUnsafeEval method which re-enables eval in the dynamic scope of the given function. I then use this to compile the keystroke grammar which saves us the complexity of pre-compiling it during specs. What do people think?
Atom — The hackable editor
Check out our guides and API documentation.
Installing
Download the latest Atom release.
Atom will automatically update when a new release is available.
Building
Follow the instructions in the build docs.