#2756·Modernizr

Security Hotspot in Modernizr 2.8.3 Detected by SonarQube

Author: chetan11fbCreated Jan 15, 2025Updated Oct 2, 2025
Labelsgood first issue

Description: In my application, I am using Modernizr version 2.8.3 (as verified via Visual Studio NuGet). However, I encountered a SonarQube security hotspot due to the following code snippet:

javascript ownerDocument.createDocumentFragment = Function('h,f', 'return function(){'); SonarQube flags this as a potential security risk, stating: "Make sure that this dynamic injection or execution of code is safe."

Questions:

Is this issue already addressed in a later version of Modernizr? If so, could you please provide guidance on how to upgrade to the latest stable version of Modernizr, including compatibility considerations?

Additional Notes:

If this is a known issue, any workaround or documentation reference would be highly appreciated. If not, I would suggest reviewing this pattern for potential improvements to avoid dynamic code execution where possible.

Thank you for your time and support. Looking forward to your response.