"unsafe-eval" in getGlobalObject
See original GitHub issueHi! The new Function('return this')();
code in the getGlobalObject
method throws an “unsafe-eval” error for CSPs with script-src 'self'
. I was able to get around this in the init of TweakPane by providing document
in the config, but when the color blade calls isBrowser
, it directly calls getGlobalObject
instead of using the config document.
Maybe there’s a way of getting the global object without using eval?
Issue Analytics
- State:
- Created 2 years ago
- Comments:6 (2 by maintainers)
Top Results From Across the Web
eval() - JavaScript - MDN Web Docs - Mozilla
The eval() function evaluates JavaScript code represented as a string and returns its completion value. The source is parsed as a script.
Read more >Can I use jQuery global eval intsead of eval to escape from ...
You can use eval() without jQuery.globaleval() in CSP by setting unsafe-eval as a allowed source. Similar to like this:
Read more >Script cannot run due to "unsafe-eval" when CSP security ...
Any specific reason why eval was chosen to get the global window object? I saw the blame history and it was along jest...
Read more >Use Tag Manager with a Content Security Policy
Due to how Custom JavaScript variables are implemented, they will evaluate to undefined in the presence of a CSP unless the 'unsafe-eval' directive...
Read more >#49812 (EvalError: Refused to evaluate a string as JavaScript ...
I am having this error when clicking on theme customization. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Nevermind… reread @destroytoday initial comment and provided the missing document
new Pane({ document: window.document });
The eval error went away!
@cocopon Thank you!!