Conversation
The dependency-token existence check in executeFormula used
eval('typeof(' + tokens[i] + ') == "undefined"'), which bundlers such as
Vite/Rollup flag and which is unnecessary for a plain global lookup.
Dependency tokens always match /[A-Z]+[0-9]+/ (cell references such as A1),
so checking typeof globalThis[token] === 'undefined' is equivalent: it
returns true for unresolvable names and for globals holding undefined, and
false for any defined global, without invoking the evaluator.
Fixes jspreadsheet#1805
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dependency-token check in
src/utils/internal.jsusedto tell undefined names from cell-reference tokens, which bundlers and CSP policies flag. Replaced with:
globalThis[token]was chosen overtoken in globalThisdeliberately: the tokens always match[A-Z]+[0-9]+(valid identifiers, never reserved words), and thetypeofform is behaviorally identical to the eval version in every case, including declared-but-undefined globals (whereinwould diverge) and throwing getters. Verified old-vs-new on six cases — real global, undefined name,A1,AB12, declared-undefined, throwing getter — identical outcomes on all six, including the thrown error on the getter.dist/index.jsis patched in place with the equivalent minified expression (repo convention keepsdistcommitted in sync withsrc); noeval(occurrences remain in it. Removing the eval also unblocks scope mangling over that code during future minified rebuilds.Requires an ES2020 runtime (Node 12+, evergreen browsers);
srcalready relies on ES2017+ (Object.entriesinfactory.js), so this is no support regression.Fixes #1805