fix(runtime): no new Function for loadEsmEntry (#3054)

Author: ScriptedAlchemy

.changeset/ai-quick-eagle.md

@@ -0,0 +1,8 @@
+---
+"@module-federation/runtime": patch
+---
+
+Replaced dynamic module import using `new Function` with a safer direct `import` call.
+
+- Removed usage of `new Function` to execute dynamic import
+- Implemented a direct async import with `/* webpackIgnore: true */` for proper bundler handling

packages/runtime/src/utils/load.ts

@@ -20,11 +20,7 @@ async function loadEsmEntry({
   return new Promise<RemoteEntryExports>((resolve, reject) => {
     try {
       if (!remoteEntryExports) {
-        // eslint-disable-next-line no-eval
-        new Function(
-          'callbacks',
-          `import("${entry}").then(callbacks[0]).catch(callbacks[1])`,
-        )([resolve, reject]);
+        import(/* webpackIgnore: true */ entry).then(resolve).catch(reject);
       } else {
         resolve(remoteEntryExports);
       }
@@ -44,11 +40,16 @@ async function loadSystemJsEntry({
   return new Promise<RemoteEntryExports>((resolve, reject) => {
     try {
       if (!remoteEntryExports) {
-        // eslint-disable-next-line no-eval
-        new Function(
-          'callbacks',
-          `System.import("${entry}").then(callbacks[0]).catch(callbacks[1])`,
-        )([resolve, reject]);
+        //@ts-ignore
+        if (typeof __system_context__ === 'undefined') {
+          //@ts-ignore
+          System.import(entry).then(resolve).catch(reject);
+        } else {
+          new Function(
+            'callbacks',
+            `System.import("${entry}").then(callbacks[0]).catch(callbacks[1])`,
+          )([resolve, reject]);
+        }
       } else {
         resolve(remoteEntryExports);
       }