# loophole

> A hack to enable use of libraries that depend on a basic form of eval in Atom

Latest version **1.1.0** (published 2015-07-29) · MIT license · 0 weekly downloads

## Install

```sh
npm install loophole
pnpm add loophole
yarn add loophole
bun add loophole
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.0 |
| Published | 2015-07-29 |
| First published | 2014-03-07 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 38 |
| Maintainers | nathansobo, kevinsawicki, benogle, maxbrunsfeld, thedaniel |

## Links

- npm: https://www.npmjs.com/package/loophole
- Repository: https://github.com/atom/loophole
- Homepage: https://github.com/atom/loophole#readme
- Issues: https://github.com/atom/loophole/issues
- npm.io page: https://npm.io/package/loophole

## Recent versions

- 1.1.0 (latest) — 2015-07-29
- 1.0.0 — 2014-03-11
- 0.4.0 — 2014-03-11
- 0.3.0 — 2014-03-08
- 0.2.0 — 2014-03-07
- 0.1.0 — 2014-03-07

## README

# Eval Loophole [![Build Status](https://travis-ci.org/atom/loophole.svg?branch=master)](https://travis-ci.org/atom/loophole)

This is a hack to enable third-party libraries that depend on a limited subset
of `eval` semantics to work in Atom with a content security policy that forbids
calls to `eval`.

```coffee
{allowUnsafeEval, allowUnsafeNewFunction} = require 'loophole'

allowUnsafeEval ->
  crazyLibrary.exploitLoophole() # allows `eval(...)`

allowUnsafeNewFunction ->
  crazyLibrary.exploitLoophole() # allows `new Function(...)`
```

You can also use the exported `Function` constructor directly:

```coffee
{Function} = require 'loophole'
f = new Function("return 1 + 1;")
```

## How?

`allowUnsafeEval` replaces `eval` with a call to `vm.runInThisContext`, which
won't perfectly emulate `eval` but is good enough in certain circumstances, like
compiling [PEG.js][peg-js] grammars.

`allowUnsafeNewFunction` temporarily replaces `global.Function` with
`loophole.Function`, which passes the source of the desired function to
`vm.runInThisContext`.

## Why?

If there's a loophole, why even enable CSP? It still prevents developers from
accidentally invoking eval with legacy libraries. For example, did you know that
jQuery runs eval when you pass it content with script tags? If you want eval,
you'll need to explicitly ask for it.

[peg-js]: http://pegjs.majda.cz/

---
_Source: https://npm.io/package/loophole · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._