Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Eliminate eval's and function constructors to comply with CSP #21

Open
axellorreyne opened this issue Mar 17, 2023 · 0 comments
Open

Eliminate eval's and function constructors to comply with CSP #21

axellorreyne opened this issue Mar 17, 2023 · 0 comments

Comments

@axellorreyne
Copy link
Contributor

axellorreyne commented Mar 17, 2023

When trying to (privately) submit the extension, the general tests fail with 3 warnings of the following kind:

  • The Function constructor is eval.
  • eval can be harmful.

For every warning, the following details are given:
Evaluation of strings as code can lead to security vulnerabilities and performance issues, even in the most innocuous of circumstances. Please avoid using 'eval' and the 'Function' constructor when at all possible.'

Because of these issues found by the validation process, the submission of the extension could be rejected
because this makes the extension non-compliant with the CSP

This problem is caused by webpack using several eval's and/or function constructors during the bundling process.

This is a well known problem within the webpack community.
Several, if not all, solutions from the above mentioned issue, as well as other issues/threads, have been tried and implemented, but none so far have resulted in the absolute absence of eval's and/or function constructors within the webpack output and therefore a successful CSP validation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant