Skip to content

Problems with CSP #86

@budarin

Description

@budarin

There is a code in the library

try {
  new Function('')
} catch(error) {
  // if eval variants are not supported, do not create inline object readers ever
  inlineObjectReadThreshold = Infinity
}

It causes problems when using Trustedtypes on the site

{
   "csp-report":{
      "document-uri":"https://site/",
      "referrer":"",
      "violated-directive":"script-src",
      "effective-directive":"script-src",
      "original-policy":"default-src 'none'; child-src 'self'; connect-src 'self'; upgrade-insecure-requests; script-src 'self' 'strict-dynamic' ...sha256 hashes...  'report-sample'; require-trusted-types-for 'script'; trusted-types webpack-tt default; form-action 'self'; base-uri 'none'; manifest-src 'self'; object-src 'none'; report-uri csp-report; frame-ancestors 'none'; img-src 'self' data: ; style-src 'self' 'unsafe-inline' 'report-sample'; worker-src 'self';",
      "disposition":"enforce",
      "blocked-uri":"eval",
      "line-number":2,
      "column-number":9822,
      "source-file":"https://site/c1091830662e60c6d816.js",
      "status-code":200,
      "script-sample":"(function anonymous(\n) {\n\n})"
   }
}

In addition to the fact that the code generates an error, it is also blocked

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions