question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

vue3 with vue-i18n-next only works with unsafe-eval CSP header

See original GitHub issue

While trying to update to Vue3, we have noticed that apps won’t work with CSP headers that don’t allow unsafe-eval. Apparently this is because the newest vue-i18n is using eval, are there any plans to fix this, or will Vue3 apps require unsafe-eval moving forward?

Module versions (please complete the following information):

  • vue: 3.0.11
  • vue-i18n: 9.1.6

To Reproduce Steps to reproduce the behavior: ex:

  1. set Content-Security-Policy header with a script-src that doesn’t contain unsafe-eaval
  2. try to use any vue3 app that contains vue-i18n-next
  3. See error in browser console

Expected behavior In many organizations the security guidelines dictate that CSP headers are set and unsafe-eval is usually not allowed

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Reactions:1
  • Comments:6 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
kascatcommented, Apr 11, 2022

An alternative is:

import { useI18n } from 'vue-i18n'
const { messages, locale } = useI18n()
console.log(messages.value?.[locale.value]?.example)

So, can create a function to otimize: messages.value?.[locale.value]?.example

Ex:

function t (labelToTranslate) {
  const localeMessages = messages.value?.[locale.value]
  const keys = (labelToTranslate || '').split('.')
  const translatedLabel = keys.reduce((ac, key) => ac?.[key], localeMessages)

  return translatedLabel !== undefined ? translatedLabel : labelToTranslate;
}

console.log(t('role.admin'))
0reactions
bencevasscommented, Jun 19, 2021

Thank you, I will have a look

Read more comments on GitHub >

github_iconTop Results From Across the Web

How to fix "unsafe-eval" error with Vue3 for the client-side ...
Yes, vue.js uses a piece of code like that: // detect possible CSP restriction try { new Function('return 1'); } catch (e) {...
Read more >
Vue Content Security Policy Guide - StackHawk
A CSP works by allowing the server to provide a response header telling the browser to only execute resources vetted by a legitimate...
Read more >
CSP: script-src - HTTP - MDN Web Docs - Mozilla
If a page has a CSP header and 'wasm-unsafe-eval' isn't specified in the script-src directive, WebAssembly is blocked from loading and executing ...
Read more >
How To Secure Node.js Applications with a Content Security ...
Leave your app running and open a new terminal window to work with your server.js file: nano server.js. Next, add the CSP header...
Read more >
CSP - problem with eval - Get Help - Vue Forum
I am trying to set CSP headers in my Vue 2.0 app and I have a problem with 'eval' policy. When I use...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found