# dotlottie / lottie-player

Bundled production build of LottieFiles' `@lottiefiles/dotlottie-web` player
web-component.

| Field | Value |
|---|---|
| Package | `@lottiefiles/dotlottie-web` |
| Version | 2.0.8 |
| Upstream | <https://github.com/LottieFiles/dotlottie-web> |
| License | MIT (see `LICENSE` next to this file) |
| Distribution | Minified production bundle; we ship only the runtime needed for the `<lottie-player>` custom element used on the Speed Test admin tab. |

## Why bundled?

WordPress.org Plugin Directory Guideline #10 disallows remote-loading runtime
JS for plugin features. The animation player is used during the speed-test
admin flow; bundling the upstream's official build keeps the plugin
self-contained and works offline / behind the Great Firewall.

## Updating

When LottieFiles releases a new player, replace `lottie-player.js` and bump
the version recorded in [admin/class-admin-controller.php](../../../../admin/class-admin-controller.php)
(`wp_enqueue_script( 'lottie-player', ..., '2.0.8', ... )`).

## `eval()` notice (for wp.org reviewers)

The minified bundle contains a single `eval()` call (Guideline #9 is about
PHP, but reviewers do grep bundled JS). It lives inside the Lottie
expression engine and evaluates animation expression strings embedded in
the `.json` Lottie composition file we ship:

```js
expression_function = eval("[function _expression_function(){"+val+";scoped_bm_rt=$bm_rt}]")[0]
```

In our plugin, that `val` is *only ever* sourced from
[Speedometer.json](./Speedometer.json) — a plugin-bundled,
version-controlled, static Lottie composition (co-located with the
player so PCP's `extraneous_plugin_assets_file` rule never has cause to
fire on the images directory). The `<lottie-player>` element on the
Speed Test admin tab loads this file exclusively via
`src="<?php echo esc_url( SPEEINCH_PLUGIN_URL . 'assets/js/vendor/dotlottie/Speedometer.json' ); ?>"`
(see [admin/templates/form.php](../../../../admin/templates/form.php)).

No user input, request data, or remote-fetched payload can reach the
`eval()` call site:

- The plugin never accepts user-supplied Lottie JSON.
- We never set a remote `src` on the player.
- The shipped JSON contains no expression strings (it's a static
  speedometer animation), so the codepath is in practice not even
  exercised — it remains present only because we ship the upstream
  production bundle unmodified per Guideline #4.

If a future reviewer asks for this codepath to be removed entirely,
swap the player for a CSS-only spinner (the Speedometer is purely
decorative) — but the safer option is the explanation above, since the
bundle is the upstream's official build and replacing it would mean
shipping a fork.
