Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

globalThis.js uses unsafe eval #92

Closed
s3curitybug opened this issue Oct 29, 2020 · 5 comments
Closed

globalThis.js uses unsafe eval #92

s3curitybug opened this issue Oct 29, 2020 · 5 comments

Comments

@s3curitybug
Copy link

return Function('return this')()

This line uses Function(), which gets blocked when used with Content Security Policy unless unsafe-eval is used.

@CJY0208
Copy link
Owner

CJY0208 commented Oct 29, 2020

It‘s from globalThis polyfill: https://github.com/es-shims/globalThis/blob/master/implementation.browser.js

Does it crash your project?

The polyfill from tc39 throw an error when the program reaches that position, looks more standardized
https://github.com/tc39/proposal-global#rationale

@s3curitybug
Copy link
Author

The browser blocks the script if Content Security Policy is used.

image

In my case, I bundle everything in just one js, so all my project gets blocked because of that line.

@CJY0208
Copy link
Owner

CJY0208 commented Oct 29, 2020

try v1.10.1

@s3curitybug
Copy link
Author

Works like a charm. Thank you!

@CJY0208
Copy link
Owner

CJY0208 commented Oct 29, 2020

OK, closed~

@CJY0208 CJY0208 closed this as completed Oct 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants