Support semicolon-separated expressions in the CSP evaluator - #4915
Open
m-develops wants to merge 1 commit into
Open
m-develops wants to merge 1 commit into
m-develops wants to merge 1 commit into
Conversation
The CSP build's parser accepted one expression and an optional trailing semicolon, so an event handler such as `count++; open = true` had to be moved into a component method. `parse()` now reads expressions separated by semicolons. They are evaluated in order and the value of the last one is the result, so a later expression sees what an earlier one assigned. A single expression parses to the same tree as before, empty expressions between separators are rejected, and a trailing semicolon stays allowed.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CSP evaluator accepts one expression per attribute. A handler such as
count++; open = true, which needs no evaluation of anything beyond what the evaluator already allows, has to be moved into a component method under the CSP build.Why now. Livewire's
csp_safemode uses this build, and Filament is working on supporting it. Filament'safterStateUpdatedJs()hooks are user-supplied strings of one or two expressions that Dan Harrin wants evaluated through this evaluator from bundled code instead of throughnew Function(): filamentphp/filament#7032 (reply in thread)What this does.
parse()reads expressions separated by semicolons. They are evaluated in order in the same scope, and the value of the last one is the result, so a later expression sees what an earlier one assigned. A single expression parses to the same tree as before, a trailing semicolon stays allowed, and empty expressions between separators (a;;b) are rejected. No statements, no declarations, no control flow: only the expressions the evaluator already accepts, one after the other.Unit tests, a Cypress test, and a docs entry.