Polymer requires unsafe-eval CSP

[willscott]

unsafe-eval, allowing javascript to call eval, is the most dangerous and least recommended policy to allow in your UI. Especially in a UI that features remote-user content like names, images, etc. we should not allow unsafe-eval.

it appears this relaxation occured in #346

@dborkan - does polymer really need unsafe-eval permissions?
@iislucas - was this considered at the point when we moved to polymer? it's a fairly gaping security issue.

[iislucas]

We should not be using unsafe eval.

[iislucas]

Sorry, maybe should not be working after redeye, I was getting confused. But Polymer does not require unsafe-eval. So we should definitely fix it.

[iislucas]

In particular, we should remove unsafe-eval from: https://github.com/uProxy/uproxy/blob/dev/src/chrome/extension/manifest.json

[dborkan]

Reopening as we are now seeing this error:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:".

I found some GitHub issues about this that suggest we should run vulcanize with the --csp flag to fix it: Polymer/polymer#612, Polymer/polymer#252

[dborkan]

Looks like we are already using the csp flag (that's what splits polymer into separate a separate JS and HTML)

[willscott]

@salomegeo can perhaps comment if this is also the reason why the firefox addon uses 'unsafe-content-script'
https://github.com/uProxy/uproxy/blob/dev/src/firefox/package.json#L11

[salomegeo]

I believe that's not needed anymore. It was necessary to share objects
between content script and page script. But we don't do that anymore I
believe.

On Fri, Mar 13, 2015 at 5:17 PM, Will notifications@github.com wrote:

@salomegeo https://github.com/salomegeo can perhaps comment if this is
also the reason why the firefox addon uses 'unsafe-content-script'
https://github.com/uProxy/uproxy/blob/dev/src/firefox/package.json#L11

—
Reply to this email directly or view it on GitHub
#679 (comment).

[dborkan]

No longer an issue