Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ES5 build breaks CSP checks #12105

Closed
menocomp opened this issue Jul 22, 2020 · 1 comment
Closed

ES5 build breaks CSP checks #12105

menocomp opened this issue Jul 22, 2020 · 1 comment

Comments

@menocomp
Copy link

menocomp commented Jul 22, 2020

Configuration:

  • Web browser and its version: IE11
  • Operating system and its version: Windows
  • PDF.js version: 2.4.456
  • Is a browser extension: No

Steps to reproduce the problem:

  1. Loading latest version 2.4.456 for ES5 build https://unpkg.com/pdfjs-dist@2.4.456/es5/build/pdf.worker.js
    2.CSP provider reports this as eval

What is the expected behaviour?
Not to use eval or Function if possible?

What went wrong?
From my CSP provider

{
    "csp-report": {
        "blocked-uri": "eval",
        "column-number": 10,
        "line-number": 1311,
        "source-file": "https://unpkg.com/pdfjs-dist@2.4.456/es5/build/pdf.worker.js",
        "violated-directive": "script-src"
    }
}

The code base is using Function("r", "regeneratorRuntime = r")(runtime); at line: 1311

The latest version in ES6 is fine:
https://unpkg.com/pdfjs-dist@2.4.456/build/pdf.worker.js

However it is there in ES5 build:
https://unpkg.com/pdfjs-dist@2.4.456/es5/build/pdf.worker.js

I do not want to allow script-src 'eval' in my CSP provider.

Is there any plan to fix ES5 build?

EDIT:
Looks like unpkg is not loading the latest version:
I tried loading https://unpkg.com/pdfjs-dist/es5/build/pdf.worker.js and it defaults to https://unpkg.com/pdfjs-dist@2.4.456/es5/build/pdf.worker.js while it should be https://unpkg.com/pdfjs-dist@2.5.207/es5/build/pdf.worker.js
But even with version 2.5.207 the code base is still using Function Function("r", "regeneratorRuntime = r")(runtime); in line 1325

@Snuffleupagus
Copy link
Collaborator

Essentially a duplicate of issue #11036.

Is there any plan to fix ES5 build?

Please note #11036 (comment); the "solution" was to provide a non-translated/non-polyfilled build, which obviously won't help the ES5-build unfortunately (but was the best we could do).

Basically, unless there's another way to polyfill async/await this issue unfortunately cannot be fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants