SIGN IN SIGN UP
facebook / react UNCLAIMED

The library for web and native user interfaces.

244272 0 0 JavaScript

[compiler][playground] parse compiler configs using json5 (#36159)

Compiler config parsing is currently done with new Function(...) which
is a XSS vulnerability. Replacing this with json parsing for safety
reasons.

Almost all compiler options (except for moduleTypeProvider) are json
compatible, so this isn't a big change to capabilities. Previously
created playground URLs with non-default configs may not be compatible
with this change, but we should be able to get the correct config
manually (by reading the JS version)
M
mofeiZ committed
2c2fd9d12c7159efef81e7ea6ec899943cf7ca33
Parent: 74568e8
Committed by GitHub <[email protected]> on 3/30/2026, 5:04:50 PM