Fix issue 1513: YUI violates Content-Security-Policy

[gerardkcohen]

Simple change to remove use of 'eval' like code from yui.js in order to satisfy any strict Content-Security-Policy headers.

Ran complete unit tests with YETI on my OSX Version 10.8.2 with Chrome Version 31.0.1650.63, Safari Version 6.0.2 (8536.26.17), and Firefox Version: 17.

[juandopazo]

That will fail with strict mode. What we need to do is wrap the whole of the YUI definition in:

(function (global) {
//...
}(this));

[caridy]

@juandopazo that will not work in nodejs because this is pointing to module when using it thru require() and pointing to global when using it thru node <script.js>.

[juandopazo]

(function (global) {
  'use strict';
  // ...
}(typeof global !== 'undefined' ? global : this));

Yuck.

[gerardkcohen]

Could we, at the very least, merge as is while more thought is put into using strict mode, supporting node, etc? As it stands now, any organizations implementing CSP, ie large financial institutions (wink wink), will block running YUI.

[okuryu]

Fixed in #1963.