Skip to content

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive #258

@nop33

Description

@nop33

Seems like when using this library in a browser environment where the CSP does not allow for 'unsafe-eval' it doesn't work.

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".

We discovered that the source of the problem are these lines of binary-parser:

compile() {
const importPath = "imports";
const ctx = this.getContext(importPath);
this.compiled = new Function(
importPath,
"TextDecoder",
`return function (buffer, constructorFn) { ${ctx.code} };`,
)(ctx.imports, TextDecoder);
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions