js-framework-benchmark
js-framework-benchmark copied to clipboard
Note: Implementation uses runtime code generation [sticky]
Update from @krausest: Please see this WIKI page for documentation of how the check is performed ** End of update**
Some frameworks, like mine, generate code at runtime, usually either via eval
or via new Function
.
In theory there could be no problems with that, but from the point of view of a user they must be more confident that something with no runtime code generation at all has no security issues deriving from that compared to something that uses runtime code generation.
There's also a CSP policy for preventing user code from generating code at runtime, as it's a desirable feature for many.
As such I think it would be useful to add an additional flag for marking frameworks that use this technique.