Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Content Security Policy and new Function(...) #123

Closed
saambarati opened this issue Sep 5, 2014 · 4 comments
Closed

Content Security Policy and new Function(...) #123

saambarati opened this issue Sep 5, 2014 · 4 comments

Comments

@saambarati
Copy link

When using a strict content security policy, using acorn will throw an exception when it calls makePredicate because it uses the Function constructor.

Here is a test case:
`

<script src="acorn.js></script>

`
@saambarati
Copy link
Author

One possible solution is to inline the results of makePredicate instead of computing it dynamically when acorn runs.

@RReverser
Copy link
Member

Some discussion on this was already in #90.

@RReverser
Copy link
Member

See #90 (comment).

RReverser added a commit to RReverser/acorn that referenced this issue Sep 12, 2014
@RReverser
Add post-compiler for CSP-safe version.
4db1e8a 
Ported from https://github.com/RReverser/acorn-csp.
Fixes acornjs#90.
Fixes acornjs#123.
@RReverser RReverser mentioned this issue Sep 12, 2014
Closed
@marijnh
Copy link
Member

marijnh commented Sep 12, 2014

I've pushed 91911bc and 0322beb to address this. You now get an acorn_csp.js file if you install from npm, which has the generated predicates pre-generated.

@marijnh marijnh closed this as completed Sep 12, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add post-compiler for CSP-safe version. RReverser/acorn
3 participants
@marijnh @RReverser @saambarati