Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Line 6 of getInferredName.js giving CSP issue for using Function #5

Open
mohiteca opened this issue Nov 28, 2024 · 3 comments
Open

Comments

@mohiteca
Copy link

mohiteca commented Nov 28, 2024

getInferredName.js line 6 uses Function which is throwing error in CSP. Can anybody please help. I don't want to use unsafe-eval to bypass this error.
getInferredName = Function('s', 'return { [s]() {} }[s].name;');
image

@ljharb
Copy link
Member

ljharb commented Nov 29, 2024

You should, because that’s the only reliable way to feature-detect name inference.

@mohiteca
Copy link
Author

mohiteca commented Nov 29, 2024

You should, because that’s the only reliable way to feature-detect name inference.

I'm already using 'unsafe-eval' but our security team wants to remove this as it has risk of inline script injection. Also, is this package inter-depedent on some other package, I haven't included it in my package.json.
Please help me bypassing unsafe-eval or some other way.

@ljharb
Copy link
Member

ljharb commented Nov 29, 2024

It doesn’t have that risk in this case, because it’s using a hardcoded string.

One option is to rewrite it in your bundler, to getInferredName = function (s) { return { [s]() {} }[s].name; };.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants