Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

"unsafe-eval" in getGlobalObject

See original GitHub issue

Hi! The new Function('return this')(); code in the getGlobalObject method throws an “unsafe-eval” error for CSPs with script-src 'self'. I was able to get around this in the init of TweakPane by providing document in the config, but when the color blade calls isBrowser, it directly calls getGlobalObject instead of using the config document.

Maybe there’s a way of getting the global object without using eval?

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:6 (2 by maintainers)

github_iconTop GitHub Comments

jsantos98commented, Feb 4, 2022

Nevermind… reread @destroytoday initial comment and provided the missing document new Pane({ document: window.document });

The eval error went away!

destroytodaycommented, Dec 13, 2021

@cocopon Thank you!!

Read more comments on GitHub >

github_iconTop Results From Across the Web

eval() - JavaScript - MDN Web Docs - Mozilla
The eval() function evaluates JavaScript code represented as a string and returns its completion value. The source is parsed as a script.
Read more >
Can I use jQuery global eval intsead of eval to escape from ...
You can use eval() without jQuery.globaleval() in CSP by setting unsafe-eval as a allowed source. Similar to like this:
Read more >
Script cannot run due to "unsafe-eval" when CSP security ...
Any specific reason why eval was chosen to get the global window object? I saw the blame history and it was along jest...
Read more >
Use Tag Manager with a Content Security Policy
Due to how Custom JavaScript variables are implemented, they will evaluate to undefined in the presence of a CSP unless the 'unsafe-eval' directive...
Read more >
#49812 (EvalError: Refused to evaluate a string as JavaScript ...
I am having this error when clicking on theme customization. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found