4 ms·
Fair warning about the use of eval in the readme. Anyone caring about CSP headers can't use this project and that anyone should be everyone even though the CSP
by morbicer 3y ago
Fair warning about the use of eval in the readme.
Anyone caring about CSP headers can't use this project and that anyone should be everyone even though the CSP header is PITA to setup.
- keepamovin 3y agoThat's a good point re CSP, while I don't want to restrict it, I also don't want to restrict developers. For example, unsafe-inline may even be required as we use inline event handler syntax. But complying with a requirement to remove unsafe-inline that some may have, would produce a worse developer experience, as you could no longer write inline handlers. I could implement turning those inlines into addEventListener calls, as I've done in good.html, but I just want to keep everything simple here, at least for now. Trade offs, ha! :) Will `new Function` also be covered by the same unsafe-eval CSP restriction? I know I could just search, but I suspect more discussion with you will be fruitful.
- morbicer 3y agoImho same problem as eval and on top of that it creates the function only in the global scope. Honestly it's a construct I've never seen out in the wild so I am not an expert.