You can call JS function without JS

Bug reports Snap! Bugs
1

SECURITY ISSUE!!!

If you execute this with JS enabled:

jsless test script pic
jsless test script pic814×56 11.7 KB

Then disable JS then running this block:
jsless test script pic (1)

You can run JS code without JS. Please fix. There could be a number of security issues. :unlock:

2

You do need js on before it can create the js function, and after you set the variable, you can't change the function, so it's not really a security issue.

3

But people could do this:

  1. Let them turn on JS.
  2. Puts malicious code.
  3. Let people to turn off JS.
  4. Malicious code that steals one of their project executed. :sob:
  5. Complain to the Snap! team
  6. Snap! team cannot recover project.
  7. Someone cries like this: :sob:
4

See this

5

No, it's absolutely not a security issue.

Please don't scream warnings about "security issues" that aren't. Folks are reading these forums and might get the wrong idea that something is wrong or dangerous about Snap when it really isn't. I'm wary of being shouted to attention by kids here. If you crave for adult interaction talk to your parents or your teachers. This is a public forum. Thank you.