-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
content security policy #1483
Comments
any updates? I am facing the same issue |
Folks, I personally have about zero experience in front-end so while I understand what "content security policy" is, I would really appreciate some more details - maybe some reproduction steps. What exactly are you trying to do that gets blocked? |
I've investigated this and created this repl that reproduces the issue and explains it in detail. tldr: Changing CPS is not necessary to use protobufjs. You shouldn't allow protobuf.js/lib/inquire/index.js Line 12 in da34f43
This issue was reported as early as version 6, see #593. However, I did find a bug while investigating this issue: inquire() can never resolve any modules when unsafe-eval is not allowed, even modules that are available. I have created #1548 to suggest that Protobufjs use a more modern method for the desired functionality of inquire(). (cc: @alexander-fenster) |
@seanlangbrown the codegen problem is not the same problem as the eval one. The eval problem has been reported many many times, has a PR and many workarounds. But I'm really stuck with codegen that violates CSP because using
Note that I'm using protobuf with the reflection mode only. |
still, an issue for me, using with chrome extension, V3 manifest doesn't allow unsafe-eval, |
Still an issue for me as well. To bad there isnt a easy workaround for this. |
For anyone still having this problem, I "fix" this locally with my build script. The only downside is, that when you need to rebuild the proto files, you need to delete You will not be able to rebuild the proto files with the CLI for instance after you have executed the command, but it will allow you to get rid of the
All it does is to return Edit: Just to make things clear, you will not be able to just rebuild the proto files with each
Afterwards, you can execute the |
protobuf.js version: 6.10.1
when web open csp, protobuf.js will block with unsafe-eval.
I find problem at codegen
What can I do to support CSP ?
The text was updated successfully, but these errors were encountered: