Avoid using eval

Is your feature request related to a problem? Please describe 🙏

I am adding a Content Security Policy to a new website that’s (happily) using instantsearch.js. I noticed that in order for search to keep working with our CSP, we have to make some exceptions:

{
  directives: {
    defaultSrc: ["'none'"],
    connectSrc: [
      '*.algolia.net',
      '*.algolianet.com'
    ],
    scriptSrc: [
      "'self'",
      "'unsafe-eval'" // exception for Algolia instantsearch.js
    ],
    styleSrc: [
      "'self'",
      "'unsafe-inline'"// exception for Algolia instantsearch.js
    ]
  }
}

Describe the solution you’d like 🤔

I would like to disallow unsafe-eval for scripts and unsafe-inline for styles in my CSP and continue using instantsearch.js

Apologies, but I have not yet looked into the specific code in this library that using eval or similar. Just opening this as a tracking issue and to hopefully get a conversation started. Thanks!

[zeke]

Sounds good @Haroenv, thanks for following up.

[zeke]

Have you been able to change your CSP with the latest version?

Haven’t tried it yet (not a top priority) but I will report back soon.