Skip to content

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive #258

Description

@nop33

Seems like when using this library in a browser environment where the CSP does not allow for 'unsafe-eval' it doesn't work.

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".

We discovered that the source of the problem are these lines of binary-parser:

compile() {
const importPath = "imports";
const ctx = this.getContext(importPath);
this.compiled = new Function(
importPath,
"TextDecoder",
`return function (buffer, constructorFn) { ${ctx.code} };`,
)(ctx.imports, TextDecoder);
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions