Make mono CSP Compliant

[TanayParikh]

Whilst investigating improving CSP compliance in Blazor, I found that Blazor WASM requires unsafe-eval due to mono's usage of eval:

runtime/src/mono/wasm/runtime/library_mono.js

Line 745 in 96cb482

const fn_res = eval (fn_eval_str);

This issue is to examine feasibility of removing this dependency on eval so that unsafe-eval is no longer required in the Blazor WASM CSP.

---

For reference, I found this article to be helpful for understanding CSP peculiarities (eval section).

[ghost]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[ghost]

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Whilst investigating improving CSP compliance in Blazor, I found that Blazor WASM requires unsafe-eval due to mono's usage of eval:

runtime/src/mono/wasm/runtime/library_mono.js

Line 745 in 96cb482

const fn_res = eval (fn_eval_str);

This issue is to examine feasibility of removing this dependency on eval so that unsafe-eval is no longer required in the Blazor WASM CSP.

---

For reference, I found this article to be helpful for understanding CSP peculiarities (eval section).

Author:	TanayParikh
Assignees:	-
Labels:	arch-wasm
Milestone:	-

[lambdageek]

A naive search shows that mono_wasm_call_function_on is used by the debug proxy. So perhaps we can move it to some JS lib that isn't used in released apps?

/cc @thaystg

[ghost]

Tagging subscribers to this area: @thaystg
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Whilst investigating improving CSP compliance in Blazor, I found that Blazor WASM requires unsafe-eval due to mono's usage of eval:

runtime/src/mono/wasm/runtime/library_mono.js

Line 745 in 96cb482

const fn_res = eval (fn_eval_str);

This issue is to examine feasibility of removing this dependency on eval so that unsafe-eval is no longer required in the Blazor WASM CSP.

---

For reference, I found this article to be helpful for understanding CSP peculiarities (eval section).

Author:	TanayParikh
Assignees:	-
Labels:	arch-wasm, untriaged, area-Debugger-mono
Milestone:	-

[lewing]

A naive search shows that mono_wasm_call_function_on is used by the debug proxy. So perhaps we can move it to some JS lib that isn't used in released apps?

/cc @thaystg

we could actually make the proxy inject the support methods and save some space

[Ponant]

@TanayParikh , it is great you out there are working on CSP cleanup.
Regarding the references for reading about CSP, you can find interesting ones here
https://github.com/Ponant/Galebra.Security/tree/master/src/Galebra.Security.Headers.Csp

[lewing]

this is gone in main

[TanayParikh]

this is gone in main

Assuming this is for 7.0?

[lewing]

yes