From 4e169976c0aec4ea23ff2c02ea9294b6838a3a44 Mon Sep 17 00:00:00 2001
From: root <chris@cjqed.com>
Date: Sun, 8 Mar 2015 12:32:30 -0400
Subject: [PATCH] No longer using eval on assert operator #386

---
 lib/chai/interface/assert.js | 29 ++++++++++++++++++++++++++++-
 test/assert.js               | 13 +++++++++----
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/lib/chai/interface/assert.js b/lib/chai/interface/assert.js
index 82d26dc6d..f37a04cb1 100644
--- a/lib/chai/interface/assert.js
+++ b/lib/chai/interface/assert.js
@@ -1007,7 +1007,34 @@ module.exports = function (chai, util) {
     if (!~['==', '===', '>', '>=', '<', '<=', '!=', '!=='].indexOf(operator)) {
       throw new Error('Invalid operator "' + operator + '"');
     }
-    var test = new Assertion(eval(val + operator + val2), msg);
+    var ok;
+    switch(operator) {
+      case '==':
+        ok = val == val2;
+        break;
+      case '===':
+        ok = val === val2;
+        break;
+      case '>':
+        ok = val > val2;
+        break;
+      case '>=':
+        ok = val >= val2;
+        break;
+      case '<':
+        ok = val < val2;
+        break;
+      case '<=':
+        ok = val <= val2;
+        break;
+      case '!=':
+        ok = val != val2;
+        break;
+      case '!==':
+        ok = val !== val2;
+        break;
+    }
+    var test = new Assertion(ok, msg);
     test.assert(
         true === flag(test, 'object')
       , 'expected ' + util.inspect(val) + ' to be ' + operator + ' ' + util.inspect(val2)
diff --git a/test/assert.js b/test/assert.js
index 1445ccb35..7637c71d2 100644
--- a/test/assert.js
+++ b/test/assert.js
@@ -563,6 +563,7 @@ describe('assert', function () {
     assert.operator(1, '>=', 1);
     assert.operator(1, '!=', 2);
     assert.operator(1, '!==', 2);
+    assert.operator(1, '!==', '1');
 
     err(function () {
       assert.operator(1, '=', 2);
@@ -579,6 +580,10 @@ describe('assert', function () {
     err(function () {
       assert.operator(1, '==', 2);
      }, "expected 1 to be == 2");
+     
+    err(function () {
+      assert.operator(1, '===', '1');
+     }, "expected 1 to be === \'1\'");
 
     err(function () {
       assert.operator(2, '<=', 1);
@@ -591,10 +596,10 @@ describe('assert', function () {
     err(function () {
       assert.operator(1, '!=', 1);
      }, "expected 1 to be != 1");
-
-    err(function () {
-      assert.operator(1, '!==', '1');
-     }, "expected 1 to be !== \'1\'");
+     
+     err(function () {
+      assert.operator(1, '!==', 1);
+     }, "expected 1 to be !== 1");
   });
 
   it('closeTo', function(){