browser-image-compression icon indicating copy to clipboard operation
browser-image-compression copied to clipboard

`eval` usage is not allowed when using a sensible CSP

Open buesing opened this issue 4 years ago • 0 comments

I recently added a content security policy to my site and now I'm seeing this error: nextZero EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob:".. It's because this library is using an eval call here: https://github.com/Donaldcwl/browser-image-compression/blob/0191a7ad0c7efaca13bb4545775974f3b3b862b7/lib/web-worker.js#L35 I'm wondering if this can be rewritten to use a different parsing strategy. Using eval is generally discouraged.

buesing avatar Jun 04 '21 11:06 buesing