-
-
Notifications
You must be signed in to change notification settings - Fork 650
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security issue - content security policy - script unsafe-eval #378
Comments
There's specially for that the CSP |
If I cannot use |
Hi there 👋 So, the only place that function inquire(moduleName) {
try {
var mod = eval("quire".replace(/^/,"re"))(moduleName); // eslint-disable-line no-eval
if (mod && (mod.length || Object.keys(mod).length))
return mod;
} catch (e) {} // eslint-disable-line no-empty
return null;
} As you can see, it is completely safe, since it replaces a static string and evaluates that (which becomes This has actually been an issue for years, but some users seem to have found a way around it: protobufjs/protobuf.js#593 Let me know if you get it right, because I think this will benefit other users too :) 🤗 |
none afaik .
… On 6 Nov 2023, at 13:51, Stian Øyna ***@***.***> wrote:
If I cannot use wasm-unsafe-eval either? What are my options then? Another library perhaps?
—
Reply to this email directly, view it on GitHub <#378 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAVUVG7E5OFFWYVFHSAT5B3YDDMOHAVCNFSM6AAAAAA64O5P6WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOJUG42DSMBRGA>.
You are receiving this because you commented.
|
Context:
I use @xenova/transformers 2.6.2 npm package from a web application to do image classifcations. Here is the gist of my setup:
Everything works code-wise but when I remove unsafe-inline in CSP, it fails with this warning in the browser console:
I cannot allow script-src: unsafe-eval in my web application (corporate rules). Do I have any alternatives?
The text was updated successfully, but these errors were encountered: