- // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
- // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+ // to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
+ // and escape the comment, thus injecting code that gets evaled.