From 513a5af7eefdc386fcec051f733c61ea04bb0af6 Mon Sep 17 00:00:00 2001 From: Andres Robinet Date: Thu, 23 May 2024 16:46:40 -0300 Subject: [PATCH 1/2] Remove eval and eslint suppressions --- libraries/botbuilder-lg/src/evaluationOptions.ts | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libraries/botbuilder-lg/src/evaluationOptions.ts b/libraries/botbuilder-lg/src/evaluationOptions.ts index 87092ea052..625b732ec6 100644 --- a/libraries/botbuilder-lg/src/evaluationOptions.ts +++ b/libraries/botbuilder-lg/src/evaluationOptions.ts @@ -87,10 +87,7 @@ export class EvaluationOptions { this.strictMode = true; } } else if (key.toLowerCase() === this.replaceNullKey.toLowerCase()) { - // eslint-disable-next-line @typescript-eslint/no-unused-vars - this.nullSubstitution = (path) => - // eslint-disable-next-line security/detect-eval-with-expression - eval('`' + value.replace(this.nullKeyReplaceStrRegex, '${path}') + '`'); // CodeQL [SM04509] Eval on content that is from a trusted source + this.nullSubstitution = (path) => value.replace(this.nullKeyReplaceStrRegex, path); } else if (key.toLowerCase() === this.lineBreakKey.toLowerCase()) { this.LineBreakStyle = value.toLowerCase() === LGLineBreakStyle.Markdown.toString().toLowerCase() From 18cd73f5b21dc23106b8ea44e9f642b035eefa8a Mon Sep 17 00:00:00 2001 From: Andres Robinet Date: Thu, 23 May 2024 18:05:23 -0300 Subject: [PATCH 2/2] Ensure path is converted to string --- libraries/botbuilder-lg/src/evaluationOptions.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/botbuilder-lg/src/evaluationOptions.ts b/libraries/botbuilder-lg/src/evaluationOptions.ts index 625b732ec6..a2cac51423 100644 --- a/libraries/botbuilder-lg/src/evaluationOptions.ts +++ b/libraries/botbuilder-lg/src/evaluationOptions.ts @@ -87,7 +87,7 @@ export class EvaluationOptions { this.strictMode = true; } } else if (key.toLowerCase() === this.replaceNullKey.toLowerCase()) { - this.nullSubstitution = (path) => value.replace(this.nullKeyReplaceStrRegex, path); + this.nullSubstitution = (path) => value.replace(this.nullKeyReplaceStrRegex, `${path}`); } else if (key.toLowerCase() === this.lineBreakKey.toLowerCase()) { this.LineBreakStyle = value.toLowerCase() === LGLineBreakStyle.Markdown.toString().toLowerCase()