Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

@@ -3,8 +3,13 @@ import {scale as get, scaleFraction} from 'vega-scale';
 import {Gradient} from 'vega-scenegraph';
 import {identity, peek} from 'vega-util';
 
-export default function(scale, p0, p1, count, group) {
-  scale = getScale(scale, (group || this).context);
+/**
+ * Passing a function is only used for for testing.
+ * Outside of tests, the first argument should be a string.
+ */
+export default function(scaleOrFunction, p0, p1, count, group) {
+
+  let scale = typeof scaleOrFunction === 'string' ? getScale(scaleOrFunction, (group || this).context) : scaleOrFunction;
 
   const gradient = Gradient(p0, p1);
 

@@ -1,19 +1,17 @@
 import {ScalePrefix} from './constants';
 import {scaleVisitor} from './visitors';
 import {Literal} from 'vega-expression';
-import {isFunction, isString, stringValue} from 'vega-util';
+import {isString, stringValue} from 'vega-util';
 import {isRegisteredScale} from 'vega-scale';
 
-export function getScale(nameOrFunction, ctx) {
+/**
+ * Name must be a string. Return undefined if the scale is not registered.
+ */
+export function getScale(name, ctx) {
 
-  if (isFunction(nameOrFunction)) {
-    return nameOrFunction;
-  }
-
-  if (isString(nameOrFunction)) {
-    const maybeScale = ctx.scales[nameOrFunction];
+  if (isString(name)) {
+    const maybeScale = ctx.scales[name];
     return (maybeScale && isRegisteredScale(maybeScale.value)) ? maybeScale.value : undefined;
-
   }
 
   return undefined;