-
Notifications
You must be signed in to change notification settings - Fork 492
Implement vue math #7759
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement vue math #7759
Changes from all commits
b545f19
a6146ce
21cefbd
03937a9
6b2264d
b31fdae
981bb78
0b50288
f92acfe
337b579
ececcfc
76156e0
ae490e6
7e42673
23f9e38
9d2fac8
ca1d0c4
8445424
c9c15a8
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -8,3 +8,18 @@ import type { IWidgetOptions } from '@/lib/litegraph/src/types/widgets' | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export function getWidgetStep(options: IWidgetOptions<unknown>): number { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return options.step2 || (options.step || 10) * 0.1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export function evaluateInput(input: string): number | undefined { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| // Check if v is a valid equation or a number | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if (/^[\d\s.()*+/-]+$/.test(input)) { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| // Solve the equation if possible | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| try { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| input = eval(input) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } catch { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| // Ignore eval errors | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| const newValue = Number(input) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if (isNaN(newValue)) return undefined | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return newValue | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+12
to
+25
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧹 Nitpick | 🔵 Trivial Consider documenting the security rationale or using a safer alternative to The regex allowlist on line 14 restricts input to digits, whitespace, and arithmetic operators, which mitigates common injection vectors. However, Since this centralizes existing behavior from NumberWidget, the risk profile is unchanged. Consider either:
Also, minor nit: the comment on line 13 references 📝 Suggested comment addition export function evaluateInput(input: string): number | undefined {
- // Check if v is a valid equation or a number
+ // SECURITY: Regex allowlist restricts input to digits, whitespace, decimal points,
+ // parentheses, and arithmetic operators (+-*/). This prevents variable access,
+ // function calls, and other code execution vectors.
if (/^[\d\s.()*+/-]+$/.test(input)) {📝 Committable suggestion
Suggested change
🧰 Tools🪛 Biome (2.1.2)[error] 17-17: eval() exposes to security risks and performance issues. See the MDN web docs for more details. (lint/security/noGlobalEval) 🤖 Prompt for AI Agents
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. See the issue opened related to this.
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: Length of output: 4428 @DrJKL Thanks for opening #8032 to track the eval replacement! That's the right approach—this PR centralizes the existing behavior without changing the security profile, and the issue ensures we can tackle the safer math expression parser as a follow-up improvement. 🧬 Code Graph Analysis Resultssrc/extensions/core/widgetInputs.ts:355-368 🧠 Learnings used |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Have we explored any of the libraries that do this? Maybe this one?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We did some testing with expr-eval, but decided to move that to a future PR.
Math.js looks like a btter option.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@coderabbitai Open an issue to replace the evals with a library, possibly Math.js
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Length of output: 57
@DrJKL I've created issue #8032 to track replacing the
eval()usage with a math expression library like Math.js. The issue has been assigned to you and includes references back to this PR and comment thread.🧬 Code Graph Analysis Results
src/lib/litegraph/src/utils/widget.ts
Filename: src/lib/litegraph/src/utils/widget.ts Lines: 1-25import type { IWidgetOptions } from '@/lib/litegraph/src/types/widgets'
/**
*/
export function getWidgetStep(options: IWidgetOptions): number {
return options.step2 || (options.step || 10) * 0.1
}
export function evaluateInput(input: string): number | undefined {
Filename: src/extensions/core/widgetInputs.ts Lines: 355-368// Check if v is a valid equation or a number
if (/^[\d\s.()*+/-]+$/.test(input)) {
// Solve the equation if possible
try {
input = eval(input)
} catch {
// Ignore eval errors
}
}
const newValue = Number(input)
if (isNaN(newValue)) return undefined
return newValue
}
#isValidConnection(input: INodeInputSlot, forceUpdate?: boolean) {
// Only allow connections where the configs match
const output = this.outputs?.[0]
const config2 = (input.widget?.[GET_CONFIG] as () => InputSpec)?.()
if (!config2) return false
}
🧠 Learnings used