Skip to content

JS: _acf-compatibility.js depends on sloppy-mode semantics (undeclared global, arguments aliasing) #460

@cbravobernal

Description

@cbravobernal

Description

The legacy compatibility layer (assets/src/js/_acf-compatibility.js) only works because the production webpack bundle keeps it in non-strict mode:

  1. maybe_get() assigns to an undeclared keys variable — a global leak; under strict mode this throws ReferenceError.
  2. add_action()'s multi-action split and Field→$el argument conversion rely on arguments aliasing, which strict mode disables — under strict mode the legacy callback wrapping silently stops working.

Any future tooling change that forces strict mode (e.g. converting the module to an ES module, or a bundler default change) breaks the acf.* legacy API used by third-party add-ons — one loudly, one silently.

Reproduction

Characterized in #450: tests/js/compatibility.test.js loads the raw source via indirect eval specifically to match production sloppy-mode semantics (see file comments).

Suggested fix

Declare var keys, capture arguments explicitly — two tiny changes that make the module strict-mode-safe without behavior change.

Found during the 2026-06 test campaign (see PR #450).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions