Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

"unsafe-eval" in getGlobalObject

See original GitHub issue

Hi! The new Function('return this')(); code in the getGlobalObject method throws an “unsafe-eval” error for CSPs with script-src 'self'. I was able to get around this in the init of TweakPane by providing document in the config, but when the color blade calls isBrowser, it directly calls getGlobalObject instead of using the config document.

Maybe there’s a way of getting the global object without using eval?

Issue Analytics

State:
Created 2 years ago
Comments:6 (2 by maintainers)

Top GitHub Comments

1reaction

jsantos98commented, Feb 4, 2022

Nevermind… reread @destroytoday initial comment and provided the missing document new Pane({ document: window.document });

The eval error went away!

1reaction

destroytodaycommented, Dec 13, 2021

@cocopon Thank you!!

Top Results From Across the Web

eval() - JavaScript - MDN Web Docs - Mozilla

The eval() function evaluates JavaScript code represented as a string and returns its completion value. The source is parsed as a script.

Can I use jQuery global eval intsead of eval to escape from ...

You can use eval() without jQuery.globaleval() in CSP by setting unsafe-eval as a allowed source. Similar to like this:

Script cannot run due to "unsafe-eval" when CSP security ...

Any specific reason why eval was chosen to get the global window object? I saw the blame history and it was along jest...

Use Tag Manager with a Content Security Policy

Due to how Custom JavaScript variables are implemented, they will evaluate to undefined in the presence of a CSP unless the 'unsafe-eval' directive...

#49812 (EvalError: Refused to evaluate a string as JavaScript ...

I am having this error when clicking on theme customization. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an...