Skip to content

Use of eval which is blocked by script-src Content Security Policy #276

@will-newmarch

Description

@will-newmarch

Is there any possible way the use of 'eval' could be removed from the library? (I realise this might be quite an integral part)

doT/doT.js

Line 40 in 8cae202

_globals = (function(){ return this || (0,eval)("this"); }());

We are having issues with it triggering security warnings around - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

Apparently as part of tightening security using CSP headers eval() is increasingly non-viable.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions