TC39 proposal that enables flexible brand checks before dynamic code loading
Browse cluster: Static Analysis & Code Quality →This is a TC39 proposal that addresses security concerns around dynamic code evaluation in JavaScript by enabling hosts to perform brand checks on code-like objects before compilation. The proposal tackles three specific problems: allowing `eval` to accept objects in addition to strings, providing type information to host callouts that decide whether compilation is permitted, and ensuring the host receives the full code string for inspection. The work is championed by koto with authorship from mikesamuel and koto, and it integrates with the Trusted Types proposal to help guard risky operations like dynamic code evaluation against attacks from untrusted sources.