question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CSP violation in Firefox due to eval()

See original GitHub issue

Hi,

we’re using CSP and therefore using eval() is forbidden. airbrake-js is using eval 4 times, so Firefox throws an error with call to eval() or related function blocked by CSP. I’m not sure why the other browsers don’t throw an error though.

Any chance to fix this?

Thanks!

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Reactions:6
  • Comments:8 (4 by maintainers)

github_iconTop GitHub Comments

1reaction
Aaroniuscommented, Jun 29, 2018

FYI, this seems to have broken our build. When using 1.4.0, we receive the following when building our app with webpack:

ERROR in ./node_modules/request/lib/har.js
Module not found: Error: Can't resolve 'fs' in '/Users/aahardy/dev/reactor/lens/node_modules/request/lib'
 @ ./node_modules/request/lib/har.js 3:9-22
 @ ./node_modules/request/request.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

ERROR in ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'net' in '/Users/aahardy/dev/reactor/lens/node_modules/forever-agent'
 @ ./node_modules/forever-agent/index.js 6:10-24
 @ ./node_modules/request/request.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

ERROR in ./node_modules/tough-cookie/lib/cookie.js
Module not found: Error: Can't resolve 'net' in '/Users/aahardy/dev/reactor/lens/node_modules/tough-cookie/lib'
 @ ./node_modules/tough-cookie/lib/cookie.js 32:10-24
 @ ./node_modules/request/lib/cookies.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

ERROR in ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'net' in '/Users/aahardy/dev/reactor/lens/node_modules/tunnel-agent'
 @ ./node_modules/tunnel-agent/index.js 3:10-24
 @ ./node_modules/request/lib/tunnel.js
 @ ./node_modules/request/request.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

ERROR in ./node_modules/forever-agent/index.js
Module not found: Error: Can't resolve 'tls' in '/Users/aahardy/dev/reactor/lens/node_modules/forever-agent'
 @ ./node_modules/forever-agent/index.js 7:10-24
 @ ./node_modules/request/request.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

ERROR in ./node_modules/tunnel-agent/index.js
Module not found: Error: Can't resolve 'tls' in '/Users/aahardy/dev/reactor/lens/node_modules/tunnel-agent'
 @ ./node_modules/tunnel-agent/index.js 4:10-24
 @ ./node_modules/request/lib/tunnel.js
 @ ./node_modules/request/request.js
 @ ./node_modules/request/index.js
 @ ./node_modules/airbrake-js/dist/client.js
 @ ./app/utils/errorReporter.js
 @ ./app/app.jsx
 @ multi babel-polyfill ./app/app.jsx

In case it helps, we’re using webpack 3.11.0.

0reactions
vmihailencocommented, Jun 30, 2018

How do you import airbrake-js?

Read more comments on GitHub >

github_iconTop Results From Across the Web

CSP: script-src - HTTP - MDN Web Docs - Mozilla
The 'wasm-unsafe-eval' source expression controls WebAssembly execution. If a page has a CSP header and 'wasm-unsafe-eval' isn't specified in ...
Read more >
Firefox add-on needs 'unsafe-eval' in CSP header #471 - GitHub
The Firefox version is not able to detect Ember application if the server sends the Content Security Policy header without 'unsafe-eval' in ...
Read more >
CSP: How to allow unsafe-eval for a given URI prefix (Firefox)
For example, the script-src supports unsafe-eval which means that any script that is otherwise allowed to execute is allowed to run eval() ......
Read more >
Content-Security-Policy Header CSP Reference & Examples
Content Security Policy (CSP) ... Try our CSP Browser Test to test your browser. ... Allows unsafe dynamic code evaluation such as JavaScript...
Read more >
Content security policy - web.dev
Learn what directives are available. Learn the keywords they take. Inline code and eval() are considered harmful. Report policy violations to ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found