Antd Less creates global JavaScript leaks

• I have searched the issues of this repository and believe that this is not a duplicate.

Version

3.6.4

Environment

Mac Node.js

Reproduction link

https://github.com/ant-design/ant-design

Steps to reproduce

I’m a maintainer of Less. There were some reported issues of using Antd with Less 3.x. I decided to try adding ant-design to Less tests. But immediately a global leak was detected by Less tests. I got the error message: Global leak detected: colorEasing, tinycolor, colorPalette

It seems that the Less files, when Inline JavaScript is enabled, add functions to the global object.

What is expected?

Less style files should not manipulate or leak into the global object.

What is actually happening?

colorEasing, tinycolor, colorPalette are leaking globally.

---

If you need help with creating a proper Less plugin (Inline JavaScript is discouraged for security and leak reasons like this), you can ask questions here: https://gitter.im/less/less.js

[matthew-dean]

@tylik1 This isn’t directly related to the inline JavaScript issue. This is what that inline JavaScript is doing (leaking into the global namespace), which is its own problem. So this isn’t so much a security vulnerability issue as a performance / memory issue. Antd shouldn’t be calling “Less” code that then has embedded JS code that is injecting vars globally into the Node runtime. There are layers of bad practices here.

[biw-joelschou]

Is the antd team bailing on this issue? I see the PR to resolve was closed rather unceremoniously (https://github.com/ant-design/ant-design/pull/20470) and switching javascriptEnabled to false in my webpack.config throws errors for .bezierEasingMixin();.