Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CSP violations for unsafe-inline in pdfjst-dist@2.0.943

See original GitHub issue

Configuration:

Chrome
Mac OSX
PDF.js version: pdfjs-dist 2.0.943
Is a browser extension: false

We have a content security policy that prevents unsafe-inline.

Unfortunately, after upgrading to 2.0.943, pdfjs-dist/build/pdf.js now has a Function("return this") call (which violates CSP.

My understanding was this was introduced when support for async/await and generators was added to the gulpfile.js.

Upon searching for the babel plugin and finding the GitHub issues, I find only two issues which don’t really seem to be covering the issue.

I’m unsure of how to build my own version of pdfjs-dist to try and isolate to see if this is definitively the issue, so just posting this to see if I can get some help/pointers!

Issue Analytics

State:
Created 5 years ago
Reactions:3
Comments:10 (4 by maintainers)

Top GitHub Comments

3reactions

timvandermeijcommented, Nov 23, 2018

The upgrade to Babel 7 is completed in #10293. Closing since there is nothing more we can do on our side now.

1reaction

timvandermeijcommented, Nov 19, 2018

Reopening to track the Babel upgrade on our side. Feel free to ping us if the upstream fix is applied and we’ll update too.

Top Results From Across the Web

unsafe-inline CSP Guide - Content Security Policy

The unsafe-inline Content Security Policy (CSP) keyword allows the execution of inline scripts or styles. Warning. Except for one very specific case, you...

how use CSP with pdf.js? I have a problem with worker

I tried add blob: in default-src, using local pdf.js (this has not errors but not work)... extra info: api.js is part of pdf.js...

Rendering of PDFs is broken due to Content Security Policy

Summary PDFs are not rendered loaded in repository and the browser console displays the following.

PDF Reader in JavaScript - JsRepos

js is a Portable Document Format (PDF) viewer that is built with HTML5. PDF.js is community-driven and supported by Mozilla. Our goal is...

1582115 - Unable to display PDF due CSP - Bugzilla@Mozilla

Bug 1582115: Exempt pdf.js from being subject to CSP from page. r=gijs ... 'unsafe-inline' https://cdnjs.cloudflare.com; object-src 'none'; base-uri 'self' ...