Spreadsheet component not working with 0.35.0

[ToniJ123]

Introduction

Offline version of latest spreadsheet component not working at all with this latest 0.35.0 release

To Reproduce

-Latest SQLPage
-Latest spreadsheet component

Actual behavior

No errors, spreadsheet component just keeps loading circle in the page and never gets spreadsheet component loaded on the page.

[ToniJ123]

[ToniJ123]

Otherwise, great work making great improvements and very happy to see some major jumps in development! 👍

[ToniJ123]

Quick view with developers tools tells that there is problems with bootstrap / tabler / apex chart colors/style libraries not founding. This may have something to do why spreadsheet component also isn't working.

[lovasoa]

I'll release a new version of the spreadsheet component very soon :)

[lovasoa]

I just released v0.6 with compatibility for the latest sqlpage: https://github.com/sqlpage/sqlpage-spreadsheet/releases/tag/v0.6.0

[ToniJ123]

Note that this version requires updating your sqlpage settings to allow code execution from inside the component. See https://github.com/sqlpage/sqlpage-spreadsheet/blob/main/demo/sqlpage/sqlpage.json

"content_security_policy": "script-src 'self' 'nonce-{NONCE}' 'unsafe-eval'"

Is every part of this necessary? This seems like an security risk, at least the last one? In what level this allows this CSP? Somehow internally in SQLpage / spreadsheet processes or does this effect the real user browser level when using producted web app?

[lovasoa]

unsafe-eval in CSP permits dynamic code execution via eval(), new Function(), etc. It's flagged as risky due to potential XSS if untrusted or improperly sanitized input reaches those calls.

However, it's not inherently unsafe. All web pages without a CSP—most of the web—implicitly allow unsafe-eval. In our case, it’s required by a trusted dependency, and all eval usage is internal and isolated from user input. Since there’s no injection vector, enabling unsafe-eval is safe here.

I'll still check whether we can do without it in future versions.