protobuf.js icon indicating copy to clipboard operation
protobuf.js copied to clipboard

@protobufjs/inquire violates default content security policy

Open sherlock1982 opened this issue 7 years ago • 6 comments

protobuf.js version: 6.8.6

There's a special code inside @protobufjs/inquire:

function inquire(moduleName) {
    try {
        var mod = eval("quire".replace(/^/,"re"))(moduleName); // eslint-disable-line no-eval
        if (mod && (mod.length || Object.keys(mod).length))
            return mod;
    } catch (e) {} // eslint-disable-line no-empty
    return null;
}

If I apply "Content-Security-Policy" without additional exceptions to allow eval than it's prohibited. Actually it's the only eval in my ~1Mb minified file. Probably there's a way to avoid it and become CSP compliant?

UPD: I'm using minimal variant with everything inbuilt.

sherlock1982 avatar Mar 09 '18 10:03 sherlock1982