Bug deion Whenever my links opens a new layer and uses the <

I'll leave my solution for reference: I had an unnoticed <code class

It states false . <a target="_blank" rel="noopener

CSP blocking `up.reload` even with `unsafe-eval` about unpoly HOT 4 CLOSED

alexandremjacques commented on June 21, 2024

CSP blocking `up.reload` even with `unsafe-eval`

from unpoly.

Comments (4)

alexandremjacques commented on June 21, 2024 1

I'll leave my solution for reference:

I had an unnoticed <meta http-equiv="Content-Security-Policy">, on my base template, with a CSP configuration that differed from what I was sending in the CSP headers.

Apparently, browsers give precedence to what is in the there over from what is comming in the CSP headers.

Removing the tag solved the problem.

from unpoly.

triskweline commented on June 21, 2024

When you're seeing the error, what is the value of up.browser.canEval()?

from unpoly.

alexandremjacques commented on June 21, 2024

It states false.

Same request:

from unpoly.

triskweline commented on June 21, 2024

That's curious. The function just tests if we can use eval() without an exception:

unpoly/src/unpoly/browser.js

Lines 63 to 72 in 78b1dc0

 const canEval = u.memoize(function() { 

 try { 

 // Don't use eval() which would prevent minifiers from compressing local variables. 

 return new Function('return true')() 

 } catch { 

 // With a strict CSP this will be an error like: 

 // Uncaught EvalError: call to Function() blocked by CSP 

 return false 

 } 

 })

from unpoly.

CSP blocking `up.reload` even with `unsafe-eval` about unpoly HOT 4 CLOSED

Comments (4)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	const canEval = u.memoize(function() {
	try {
	// Don't use eval() which would prevent minifiers from compressing local variables.
	return new Function('return true')()
	} catch {
	// With a strict CSP this will be an error like:
	// Uncaught EvalError: call to Function() blocked by CSP
	return false
	}
	})