Add @nyariv/sandboxjs dependency and refactor function execution to use sandbox

Author: tacxou

package.json

@@ -20,6 +20,7 @@
     "@nuxt-alt/auth": "^3.1.6",
     "@nuxt-alt/http": "^1.7.10",
     "@nuxt-alt/proxy": "^2.5.8",
+    "@nyariv/sandboxjs": "^0.8.23",
     "@pinia/nuxt": "^0.5.1",
     "@quasar/extras": "^1.16.9",
     "@vueuse/router": "^10.7.2",

src/composables/useColumnsIdentities.ts

@@ -1,5 +1,6 @@
 import type { QTableProps } from 'quasar'
 import type { components } from '#build/types/service-api'
+import Sandbox from '@nyariv/sandboxjs'
 
 type Identity = components['schemas']['IdentitiesDto']
 
@@ -31,15 +32,23 @@ const daysjs = useDayjs()
 
 function processFieldValue(row: any, field: any) {
   if (field.type === 'function') {
-    return eval(field.value);
+    const sandbox = new Sandbox();
+    const exec = sandbox.compile('return ' + field.value, true);
+
+    return exec({ row }).run();
   }
+
   return row[field];
 }
 
 function processFormat(value: any, format: any) {
   if (format && format.type === 'function') {
-    return eval(format.value);
+    const sandbox = new Sandbox();
+    const exec = sandbox.compile('return ' + format.value, true);
+
+    return exec({ value }).run();
   }
+
   return Array.isArray(value) ? value?.join(', ') : value;
 }
 

yarn.lock

@@ -1105,6 +1105,11 @@
     vite-plugin-checker "^0.6.4"
     vue-bundle-renderer "^2.0.0"
 
+"@nyariv/sandboxjs@^0.8.23":
+  version "0.8.23"
+  resolved "https://registry.yarnpkg.com/@nyariv/sandboxjs/-/sandboxjs-0.8.23.tgz#6903ff28343988f12f142f79c577fbd226288920"
+  integrity sha512-OaD3i0czFTZzQFQdwgFVEqNyZVK19N6Jzmx/LjmDc+kiV751FQ2h3xscYkAeY4jfau2vZTZau+xR8fpkKrv/Ng==
+
 "@parcel/watcher-android-arm64@2.4.1":
   version "2.4.1"
   resolved "https://registry.yarnpkg.com/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.4.1.tgz#c2c19a3c442313ff007d2d7a9c2c1dd3e1c9ca84"