Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add renderer config that disables expressions #2833

Merged
merged 2 commits into from
Aug 14, 2022

Conversation

mbasaglia
Copy link
Collaborator

This adds a setting that disables expressions (they are kept enabled by default). This is to add some security when you don't want animations to run javascript on your page.

Passing something like this to loadAnimation() will ensure expressions are not executed:

    {
        container: document.getElementById('lottie_container'),
        renderer: 'svg',
        loop: true,
        autoplay: true,
        animationData: data,
        rendererSettings: {
            runExpressions: false,
        }
    }

@bodymovin bodymovin merged commit 8455c07 into airbnb:master Aug 14, 2022
@mbasaglia mbasaglia mentioned this pull request Aug 22, 2022
@elizabethsjudd
Copy link

I'm turning on this setting based on feedback from our security team. Is there any way to verify this is not using eval()? I still see in our build a warning that eval was detected.

@mbasaglia
Copy link
Collaborator Author

It's still in the code but this setting is read before the expression is evaluated.

dreamoftrees pushed a commit to immutable/lottie-web-threejs that referenced this pull request Jul 4, 2023
Add renderer config that disables expressions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants