Replace eval() with new Function()

[duzun]

trafficstars

Replace

eval(attrValue)

with

(new Function('return ('+attrValue+')'))()

Why?

eval() is evaluated in the scope where it is called, which exposes all the (private) variables to the string script being evaluated. Besides security considerations, it disables mangling of all variables names in the scope (and all parent scopes) during code minification, because every variable could be potentially used in the eval().

The (new Function(str))() approach is much safer, cause it does not have access to the current scope.