On 3/7/19 10:27 PM, Martin Thomson wrote:
> Is there a way that doesn't rely on eval or eval-like mechanisms?
I suspect the only detectable thing here (and Jon might wake up tomorrow
and tell me I'm wrong!) is that import('stuff') is a syntax error
without the support but is not a syntax error otherwise.
That means you need to trigger at least a new parse of some JS that you
control to run the detection.
Now you could probably manage this with something like (using non-inline
scripts for all this stuff):
<script>
var oldError = window.onerror;
window.onerror = function(...args) {
/* check for syntax error */
}
</script>
<script>function() { import(''); }</script>
<script>window.onerror = oldError;</script>
or so.
-Boris