From 48f06041d1de23c2455f53206668b2b8579b85d0 Mon Sep 17 00:00:00 2001 From: HE Shi-Jun Date: Fri, 16 Nov 2018 17:20:53 +0800 Subject: [PATCH] Drop unuseful `eval` call If use CSP (without `unsafe-eval`), both `new Function` and `eval` will be forbidden, so `eval` part is just dead code. The only possibility `eval` part would run was `new Function('return this')()` return a falsy value, but it never possible as the spec (Is there any old engine violate this? Never heard about that.) This pr also add `new` keyword to make the code a little bit explicit. --- buildin/global.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/buildin/global.js b/buildin/global.js index 35f3144e9..2e7bf0b6a 100644 --- a/buildin/global.js +++ b/buildin/global.js @@ -7,7 +7,7 @@ g = (function() { try { // This works if eval is allowed (see CSP) - g = g || Function("return this")() || (1, eval)("this"); + g = g || new Function("return this")(); } catch (e) { // This works if the window reference is available if (typeof window === "object") g = window;