Enable strict mode by removing with

[coolaj86]

This is just a proof-of-concept to address #3832.

It isn't yet fully tested, but it will run the markdown demo.

[yyx990803]

Sorry, but this is more complicated than just prefixing the expression. You need to do proper parsing to prefix all valid identifiers, and there's also scope analysis involved inside functions with arguments.

[coolaj86]

@yyx990803 would you mind explaining this to me or linking me to a place in the code of what you're talking about?

My experience has been that anything that can be done with with and eval can be done without them (just like any iterative program can be recursive, right?)

By scope analysis do you mean angular-style dynamic injection?

Angular 1 with ng-strict is currently the only framework that works securely in true JavaScript (i.e. ES5.1) without build tools, but it's so bloated. I really want to use vue.js because it seems like it wouldn't require that much to make strict and secure sans build tools and I'm willing to put in work to make that happen.

[yyx990803]

It's true that it can be done, but it's not as trivial as you might have thought.

E.g. how do you transform the following:

with (this) {
  return h('div', {
    class: { a: someVariable }
  }, list.map(item => h('span', item.text))
}

1. Notice that the class binding expression is an object literal: "{ a: someVariable }" - you'd need to parse the expression to properly prefix someVariable instead of the entire expression. And because users can use arbitrarily complex expressions in the template, you essentially need a full JavaScript parser (which is why ng1 is bloated).
2. Notice inside the scope of the map function, item is a local variable because of the argument, and it should not be prefixed. This requires keeping track of the identifier information in current function scope while doing the prefixing.

So basically, it is possible, but only with a proper JavaScript parse -> AST transform -> codegen process, a la Babel. This is why in #4115 (comment) I suggest separating the prefixing from the current compiler implementation.