From fe812048a4a80550ba5c4b51da6048aa13d83cff Mon Sep 17 00:00:00 2001
From: Chiedo <chiedo@users.noreply.github.com>
Date: Wed, 21 Oct 2020 08:43:04 -0400
Subject: [PATCH] Make the rendering engine safe

---
 lib/react/engine.js | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/react/engine.js b/lib/react/engine.js
index 3df2ac283b..2e5b169027 100644
--- a/lib/react/engine.js
+++ b/lib/react/engine.js
@@ -1,12 +1,11 @@
 const { renderToString } = require('react-dom/server')
 const { transform } = require('./babel')
-
-// These all need to be here even though eslint doesn't think so
-/* eslint-disable */
 const React = require('react')
-const CodeBlock = require('../../dist/react/CodeBlock')
-const CodeEditor = require('../../dist/react/CodeEditor')
-/* eslint-enable */
+
+const components = {
+  CodeBlock: require('../../dist/react/CodeBlock'),
+  CodeEditor: require('../../dist/react/CodeEditor')
+}
 
 const renderReact = async componentStr => {
   // Get component name as string so we can use it in the class name
@@ -15,10 +14,17 @@ const renderReact = async componentStr => {
   // Add the wrapper and class name so we can later use React hydration on the client
   // side
   const jsx = `<div className="react-component-${componentName}">\n${componentStr}\n</div>`
+
   const component = transform(jsx)
 
   // eslint-disable-next-line
-  return renderToString(eval(component))
+  const getComponent = new Function(
+    'React',
+    ...Object.keys(components),
+    `${component.replace('React', 'return React')}`
+  )
+
+  return renderToString(getComponent(React, ...Object.values(components)))
 }
 
 module.exports = {