Search for JS() calls recursively only in explicit lists and data.f…

…rames (#467)

* Use type-safe name assignment

Names are characters, explicitly cast indices to characters

* Recurse over explicit lists and data.frames

Avoids recursion of list-like objects that aren't actually lists.
Recursion over data.frames is uncommon but was previously
supported and can, in theory, contain `JS()` calls in list columns.

* docs: Add news item

NEWS.md

@@ -1,5 +1,9 @@
 # htmlwidgets (development version)
 
+### Potentially breaking changes
+
+* Closed #466: htmlwidgets no longer recurses into list-like objects when searching for JavaScript strings wrapped in `JS()`, unless the object has the class `"list"` or `"data.frame"`. This stops htmlwidgets from (possibly infinitely) recursively searching objects that are not actually recursive. Widget authors who relied on the previous behavior should ensure that their widget's `JS()` calls are wrapped in objects that have the class `"list"` or `"data.frame"`. (#467)
+
 
 # htmlwidgets 1.6.2
 

R/utils.R

@@ -161,11 +161,11 @@ JSEvals <- function(list) {
 #' @noRd
 #' @keywords internal
 shouldEval <- function(options) {
-  if (is.list(options)) {
+  if (inherits(options, c("list", "data.frame"))) {
     if ((n <- length(options)) == 0) return(FALSE)
     # use numeric indices as names (remember JS indexes from 0, hence -1 here)
     if (is.null(names(options)))
-      names(options) <- seq_len(n) - 1L
+      names(options) <- as.character(seq_len(n) - 1L)
     # Escape '\' and '.' by prefixing them with '\'. This allows us to tell the
     # difference between periods as separators and periods that are part of the
     # name itself.