LWCExpertsecuritylockerthird-party
Review use of eval and dynamic script injection in third-party LWC wrapper
Real World Scenario
Vendor wrapper LWC loads analytics script via dynamic script tag and parses JSON config with Function constructor; security review flags before AppExchange submission.
Expected Answer
• Reject Function constructor and eval — blocked or restricted in Locker and LWS
• Load third-party scripts only from approved static resources or documented CSP allowlist
• Use JSON.parse not eval for config payloads
• Vendor must provide Locker-compatible integration or LWS migration path
• Security review checklist for AppExchange: no innerHTML with user data, no eval
• Pen test dynamic script loading in Experience Cloud context
• Document data sent to third parties in privacy assessment
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Reject Function constructor and eval — blocked or restricted in Locker and LWS Also consider: Load third-party scripts only from approved static resources or documented CSP allowlist In practice: Use JSON.parse not eval for config payloads Validate against production-scale constraints and long-term platform evolution.
Architect Perspective
AppExchange security rejects eval patterns — architect vendor selection with Locker compatibility upfront.