mirror of
https://github.com/denoland/deno.git
synced 2024-12-13 11:02:19 -05:00
918c5e648f
A security feature of JSR is that it is self contained other than npm dependencies. At publish time, the registry rejects packages that write code like this: ```ts const data = await import("https://example.com/evil.js"); ``` However, this can be trivially bypassed by writing code that the registry cannot statically analyze for. This PR prevents Deno from loading dynamic imports that do this.
1 line
50 B
TypeScript
1 line
50 B
TypeScript
await import("http://localhost:4545/welcome.ts");
|