qiniu-uploader icon indicating copy to clipboard operation
qiniu-uploader copied to clipboard

Published 20 hours ago • verified publisher icon knightli

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an al...

Open 91wangmeng opened this issue 8 years ago • 14 comments

[Enter steps to reproduce below:]

  1. ...
  2. ...

Atom Version: 1.12.4 Electron Version: 1.3.9 System: Mac OS X 10.10.5 Thrown From: qiniu-uploader package, v0.0.3

Stack Trace

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

At /Users/wmm/.atom/packages/qiniu-uploader/node_modules/sync-request/index.js:10

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

    at Object.<anonymous> (/Users/wmm/.atom/packages/qiniu-uploader/node_modules/sync-request/index.js:10:1)
    at Module._compile (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:103:30)
    at Object.value [as .js] (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/compile-cache.js:201:21)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:50:27)
    at Object.<anonymous> (/Users/wmm/.atom/packages/qiniu-uploader/node_modules/qiniu/qiniu/zone.js:1:94)
    at Module._compile (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:103:30)
    at Object.value [as .js] (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/compile-cache.js:201:21)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:50:27)
    at Object.<anonymous> (/Users/wmm/.atom/packages/qiniu-uploader/node_modules/qiniu/qiniu/io.js:11:12)
    at Module._compile (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:103:30)
    at Object.value [as .js] (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/compile-cache.js:201:21)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:50:27)
    at Object.<anonymous> (/Users/wmm/.atom/packages/qiniu-uploader/node_modules/qiniu/index.js:8:7)
    at Module._compile (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/native-compile-cache.js:103:30)
    at Object.value [as .js] (/Users/wmm/Downloads/Atom.app/Contents/Resources/app.asar/src/compile-cache.js:201:21)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)

Commands

     -0:00.0 core:paste (atom-text-editor.editor.is-focused)

Config

{
  "core": {
    "telemetryConsent": "no"
  }
}

Installed Packages

# User
activate-power-mode, v1.1.0 (active)
color-picker, v2.2.3 (active)
markdown-assistant, v0.2.0 (active)
qiniu-uploader, v0.0.3 (inactive)
atom-dark-syntax, v0.27.0 (inactive)
atom-dark-ui, v0.52.0 (inactive)
atom-light-syntax, v0.28.0 (inactive)
atom-light-ui, v0.45.0 (inactive)
base16-tomorrow-dark-theme, v1.3.0 (inactive)
base16-tomorrow-light-theme, v1.3.0 (inactive)
one-dark-ui, v1.6.2 (active)
one-light-ui, v1.6.2 (inactive)
one-dark-syntax, v1.5.0 (active)
one-light-syntax, v1.5.0 (inactive)
solarized-dark-syntax, v1.0.5 (inactive)
solarized-light-syntax, v1.0.5 (inactive)
about, v1.7.0 (active)
archive-view, v0.62.0 (active)
autocomplete-atom-api, v0.10.0 (active)
autocomplete-css, v0.13.1 (active)
autocomplete-html, v0.7.2 (active)
autocomplete-plus, v2.31.4 (active)
autocomplete-snippets, v1.11.0 (active)
autoflow, v0.27.0 (inactive)
autosave, v0.23.1 (active)
background-tips, v0.26.1 (active)
bookmarks, v0.42.0 (active)
bracket-matcher, v0.82.2 (active)
command-palette, v0.39.0 (inactive)
deprecation-cop, v0.54.1 (active)
dev-live-reload, v0.47.0 (active)
encoding-selector, v0.22.0 (active)
exception-reporting, v0.40.0 (active)
find-and-replace, v0.202.2 (inactive)
fuzzy-finder, v1.4.0 (active)
git-diff, v1.1.0 (active)
go-to-line, v0.31.0 (inactive)
grammar-selector, v0.48.2 (active)
image-view, v0.60.0 (active)
incompatible-packages, v0.26.1 (active)
keybinding-resolver, v0.35.0 (active)
line-ending-selector, v0.5.0 (active)
link, v0.31.2 (inactive)
markdown-preview, v0.158.8 (active)
metrics, v1.1.2 (active)
notifications, v0.65.1 (active)
open-on-github, v1.2.1 (inactive)
package-generator, v1.0.1 (inactive)
settings-view, v0.243.1 (active)
snippets, v1.0.4 (active)
spell-check, v0.68.4 (active)
status-bar, v1.4.1 (active)
styleguide, v0.47.2 (active)
symbols-view, v0.113.1 (inactive)
tabs, v0.103.0 (active)
timecop, v0.33.2 (active)
tree-view, v0.210.0 (active)
update-package-dependencies, v0.10.0 (active)
welcome, v0.35.1 (active)
whitespace, v0.35.0 (active)
wrap-guide, v0.38.2 (active)
language-c, v0.54.0 (active)
language-clojure, v0.22.1 (active)
language-coffee-script, v0.48.0 (active)
language-csharp, v0.13.0 (active)
language-css, v0.40.1 (active)
language-gfm, v0.88.0 (active)
language-git, v0.15.0 (active)
language-go, v0.43.0 (active)
language-html, v0.46.1 (active)
language-hyperlink, v0.16.1 (active)
language-java, v0.24.0 (active)
language-javascript, v0.122.0 (active)
language-json, v0.18.3 (active)
language-less, v0.29.6 (active)
language-make, v0.22.2 (active)
language-mustache, v0.13.0 (active)
language-objective-c, v0.15.1 (active)
language-perl, v0.37.0 (active)
language-php, v0.37.3 (active)
language-property-list, v0.8.0 (active)
language-python, v0.45.1 (active)
language-ruby, v0.70.2 (active)
language-ruby-on-rails, v0.25.1 (active)
language-sass, v0.57.0 (active)
language-shellscript, v0.23.0 (active)
language-source, v0.9.0 (active)
language-sql, v0.25.0 (active)
language-text, v0.7.1 (active)
language-todo, v0.29.1 (active)
language-toml, v0.18.1 (active)
language-xml, v0.34.12 (active)
language-yaml, v0.27.1 (active)

# Dev
No dev packages

91wangmeng avatar Nov 19 '16 14:11 91wangmeng

+1

stephen-v avatar Nov 23 '16 10:11 stephen-v

+1

cyzaoj avatar Nov 26 '16 06:11 cyzaoj

+1

djblovecxc avatar Dec 08 '16 02:12 djblovecxc

我也上遇到同样的问题。排查后，发现我的系统ATOM调用sync-request模块会发生此类错误。

错误原因分析：

  • 在我的系统环境下，ATOM的插件中一旦调用sync-request就会发生‘'unsafe-eval’ ’错误。
  • 若改用其他的HTTP请求同步处理模块，也会出现其它错误。如，当使用urllib-sync时候，也出现错误。怀疑，自己的系统环境无法进行http请求同步操作。
  • qiniu-uploader在它的qiniu模块的zone.js文件中调用了sync-request。 zone.js的一个重要作用是获取qiniu云的域名。实际上，安装qiniu-uploader之后，就可以配置qiniu帐号相关的信息，包括域名。并不需要zone.js像云端发起请求来获取。

解决方法：

为了能继续使用qiniu-uploader，可以采用以下两种方法解决这个问题，修改后亲测可用。

具体代码可以参考：

我的git: https://github.com/jingchen2222/nodejs-sdk.v6/tree/my-new-feature 如果操作不成功，或有其他问题可以在我的git上留言。

###方法一：

  • 修改zone.js，关闭zone.js中的http同步请求，使用AUTOZONE的配置=true：

  • File Path：~/.atom/packages/qiniu-uploader/node_modules/qiniu/qiniu/zone.js

修改前：

exports.up_host = function (uptoken, conf){

    var version = process.versions;
    var num = version.node.split(".")[0];

    // node 版本号低于 1.0.0, 使用默认域名上传，可以在conf中指定上传域名
    if(num < 1 ){
        conf.AUTOZONE = false;
    }

    if(!conf.AUTOZONE){
        return;
    }

….
}

修改后：

exports.up_host = function (uptoken, conf){

    var version = process.versions;
    var num = version.node.split(".")[0];

    // node 版本号低于 1.0.0, 使用默认域名上传，可以在conf中指定上传域名
    conf.AUTOZONE = true;

    if(!conf.AUTOZONE){
        return;
    }

….
}

修改后，无论node版本如何，都使用AUTOZONE，实际上，会自动从qiniu-uploader的配置中获取域名。

方法二：将zone.js获取zone的请求改为异步获取：

  • step 1: zone.js中添加函数：
…
// 添加代码如下：
var urllib = require('urllib');
var util = require('./util');
exports.up_host_async = function (uptoken, conf, callback){

    var version = process.versions;
    var num = version.node.split(".")[0];

    // node 版本号低于 1.0.0, 使用默认域名上传，可以在conf中指定上传域名
    if(num < 1 ){
        conf.AUTOZONE = false;
    }

    if(!conf.AUTOZONE){
        callback();
        return;
    }

    var ak = uptoken.toString().split(":")[0];
    var tokenPolicy = uptoken.toString().split(":")[2];
    var tokenPolicyStr = new Buffer(tokenPolicy, 'base64').toString();
    var json_tokenPolicyStr = JSON.parse(tokenPolicyStr);

    var scope = json_tokenPolicyStr.scope;
    var bucket = scope.toString().split(":")[0];

    // bucket 相同，上传域名仍在过期时间内
    if((new Date().getTime() < conf.EXPIRE) && bucket == conf.BUCKET){
        callback();
        return;
    }

    //记录bucket名
    conf.BUCKET = bucket;
    var request_url = 'http://uc.qbox.me/v1/query?ak='+ ak + '&bucket=' + bucket;
    var data = {
      contentType: 'application/json',
      method: 'GET',
    };

    var req = urllib.request(request_url, data, function(err, result, res) {
      // console.log(result);
      if(res.statusCode == 200){
          // console.log(result);
          var json_str = JSON.parse(result.toString());
          // console.log(json_str);
          //判断设置使用的协议, 默认使用http
          if(conf.SCHEME == 'http'){
              conf.UP_HOST = json_str.http.up[1];
          }else{
              conf.UP_HOST = json_str.https.up[0];
          }

          conf.EXPIRE = 86400 + new Date().getTime();
          callback();
          return;
      }else{
          var err = new Error('Server responded with status code ' + res.statusCode + ':\n' + res.body.toString());
          err.statusCode = res.statusCode;
          err.headers = res.headers;
          err.body = res.body;
          throw err;
          callback();
      }
    });

    return;
}

step 2： 修改io.js文件

File Path：~/.atom/packages/qiniu-uploader/node_modules/qiniu/qiniu/io.js 修改函数：putReadable

修改后：

// onret: callback function instead of ret
function putReadable (uptoken, key, rs, extra, onret) {
  if (!extra) {
    extra = new PutExtra();
  }
  if (!extra.mimeType) {
    extra.mimeType = 'application/octet-stream';
  }

  if (!key) {
    key = exports.UNDEFINED_KEY;
  }

  rs.on("error", function (err) {
      onret({code: -1, error: err.toString()}, {});
  });

  // 设置上传域名
  zone.up_host_async(uptoken, conf, function() {
      var form = getMultipart(uptoken, key, rs, extra);
      return rpc.postMultipart(conf.UP_HOST, form, onret);
  });

}

jingchen2222 avatar Dec 09 '16 09:12 jingchen2222

+1 看不懂怎么改,貌似要改源码的样子. 什么时候qiuniu-uploader会更新么

shalk avatar Dec 16 '16 08:12 shalk

按照你说的改了，还是有问题 image

xiaoli123 avatar Mar 06 '17 02:03 xiaoli123

确实不行，我跟楼上一样，按方法一操作的

idelin avatar Mar 27 '17 09:03 idelin

同样遇到了这个问题

Mrfuture1 avatar Apr 07 '17 07:04 Mrfuture1

@jingchen2222 谢谢分享，我的按照到第一种方法成功了

DRPrincess avatar Apr 30 '17 13:04 DRPrincess

@jingchen2222 好吧，没有成功，是我看错了，只是安装成功了，但是还是报错

DRPrincess avatar Apr 30 '17 15:04 DRPrincess

@DRPrincess @Mrfuture1 @idelin @91wangmeng

我参照这个插件写了个阿里云OSS的uploader，see https://github.com/airclear/oss-uploader

airclear avatar Jun 11 '17 02:06 airclear

@Mrfuture1 @idelin @91wangmeng

把@jingchen2222 给的链接中的三个文件 io.js文件、rpc.js、zone.js 复制下来替换我们本地下载下的qiniu_uploader 中的对应文件，就能解决问题。

但是要注意 要复制 my_new_feature分支中的文件，那个才是最新的，修改过这个问题的。

DRPrincess avatar Jun 14 '17 06:06 DRPrincess

+1

MarcuSacramento avatar Aug 10 '17 20:08 MarcuSacramento

亲测，@DRPrincess 的方法可行

fanjinhao avatar Aug 30 '17 14:08 fanjinhao