-
Notifications
You must be signed in to change notification settings - Fork 325
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove use of unsafe-eval #269
Comments
Can you link to the code that is doing the |
searching for Which gets in because of the Investigating how to disable it (it's not actually present in our config file https://github.com/ipfs/aegir/blob/master/config/webpack.js) |
FYSA we need to resolve this two-three weeks before Firefox 57 is released, otherwise users will be left dry without working browser extension :( |
I believe we used the @dignifiedquire sounds like the removal of |
I do not think the issue is the |
I believe I found the offender. The shim for |
Here: https://github.com/indutny/asn1.js/blob/master/lib/asn1/api.js#L21 to be exact |
Need to think more about this, but I'm guessing that we can get rid of this https://github.com/substack/vm-browserify/blob/master/index.js#L105 |
Mozilla rejected our submission due to ipfs-companion/add-on/manifest.json Line 78 in bbeadde
They may not care if Which I can't do because @dignifiedquire It fails to load under both Firefox and Chrome: |
@lidel @diasdavid I have an experimental build which should improve things, could you try this out and let me know if it helps? (based on |
@dignifiedquire I replaced Seems that |
@lidel you never had issues with If we were to try #248, we would need to figure out |
@diasdavid correct, |
@lidel @dignifiedquire what's the status here, any other ideas? |
No good ideas on my end, just status update: Firefox release is blocked due to The best case would be to find an upstream fix: the problem is not limited to this extension, as you've seen in ipfs-inactive/browser-laptop#1 (review) use of There is a possibility we could find a workaround and sandbox |
Update: Found out the |
Step 1: ipfs/js-ipfs-unixfs#18 |
Step 2: ipld/js-ipld-dag-pb#39 |
Step 3: libp2p/js-libp2p-crypto#107 |
@lidel build without protocol-buffers lib and no |
@dignifiedquire this version works without FYI there was one CSP error: it was triggered by this line of var mod = eval("quire".replace(/^/,"re"))(moduleName); // eslint-disable-line no-eval but from what I was able to check it does not impact anything we use in browser extension. As long as we don't have Is it technically possible? |
Great to hear that @lidel. That eval is coming from our new protobuf library: protobufjs/protobuf.js#593 but should hopefully resolved soonish. |
@lidel latest release of js-ipfs-api should be free of eval, hopefully. Please give it another try :) |
@dignifiedquire The latest one at npmjs.com is I guess either you did not publish the latest version yet or there is some kind of regression since |
@lidel I was lucky with js-ipfs, you might have to do a fresh npm install and fresh npm run build with ipfs-api. |
Just to eliminate possibility of me going insane 🙃 Does: curl -s https://unpkg.com/ipfs-api@14.3.3/dist/index.js | grep -B 10 Function.apply return: var src = 'return ('+line.toString()+')'
var keys = Object.keys(scope || {}).map(function(key) {
return key
})
var vals = keys.map(function(key) {
return scope[key]
})
return Function.apply(null, keys.concat(src)).apply(null, vals) on your boxes as well? |
Seems something went wrong in the release, unpkg version shows Function.apply but when I build on master with fresh deps it the apply is gone |
|
AWESOME 🎉 |
We allowed
unsafe-eval
in browser extension because browserified bundleipfs-api.min.js
relies oneval
. Unfortunately Mozilla does not accept extensions withunsafe-eval
:We need to address it somehow.
Any ideas @ipfs/javascript-team?
Is it possible to create own bundle without
eval
?We can start using webpack if needed.
The text was updated successfully, but these errors were encountered: