Make the rendering engine safe

lib/react/engine.js

@@ -1,12 +1,11 @@
 const { renderToString } = require('react-dom/server')
 const { transform } = require('./babel')
-
-// These all need to be here even though eslint doesn't think so
-/* eslint-disable */
 const React = require('react')
-const CodeBlock = require('../../dist/react/CodeBlock')
+
-const CodeEditor = require('../../dist/react/CodeEditor')
+const components = {
-/* eslint-enable */
+  CodeBlock: require('../../dist/react/CodeBlock'),
+  CodeEditor: require('../../dist/react/CodeEditor')
+}
 
 const renderReact = async componentStr => {
   // Get component name as string so we can use it in the class name
@@ -15,10 +14,17 @@ const renderReact = async componentStr => {
   // Add the wrapper and class name so we can later use React hydration on the client
   // side
   const jsx = `<div className="react-component-${componentName}">\n${componentStr}\n</div>`
+
   const component = transform(jsx)
 
   // eslint-disable-next-line
-  return renderToString(eval(component))
+  const getComponent = new Function(
+    'React',
+    ...Object.keys(components),
+    `${component.replace('React', 'return React')}`
+  )
+
+  return renderToString(getComponent(React, ...Object.values(components)))
 }
 
 module.exports = {