fix: replace eval with globalThis to comply with CSP policies #1232
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
@eugene-stativka is attempting to deploy a commit to the CodeSandbox Team on Vercel. A member of the Team first needs to authorize it. |
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. |
|
This PR looks very good! Could you run a Prettier format on the file? After that it should be ready to merge 👍 |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
**Issue:** Sandpack currently uses `eval` to obtain the global object, which triggers CSP `unsafe-eval` violations. This poses security risks and limits the ability to use Sandpack in environments with strict CSP policies. **Solution:** Replaced the `eval`-based approach with an IIFE that sequentially checks for `globalThis`, `self`, `window`, and `global` to securely access the global object without violating CSP policies. **Testing:** - Tested in a local development environment with CSP enforced to ensure no violations occur. **Related Issue:** - [1221](#1221)
eugene-stativka
force-pushed
the
main
branch
from
12eb665 to
b88e31d
Compare
Thanks, @CompuIves! I just ran Prettier and force-pushed an amended commit. Please take a look when you have time. |
What kind of change does this pull request introduce?
Issue:
Sandpack currently uses
evalto obtain the global object, which triggers CSPunsafe-evalviolations. This poses security risks and limits the ability to use Sandpack in environments with strict CSP policies.Solution:
Replaced the
eval-based approach with an IIFE that sequentially checks forglobalThis,self,window, andglobalto securely access the global object without violating CSP policies.Testing:
Tested in a local development environment with CSP enforced to ensure no violations occur.
Related Issue:
#1221
Checklist