use of eval() in dimension-handler.js requires undesirable CSP script-src 'unsafe-eval' #74
Comments
ewilligers
pushed a commit
to ewilligers/web-animations-js
that referenced
this issue
Jul 18, 2017
We no longer rely on 'eval'. Instead, we parse the calc expression and compute the value. We take advantage of the requirement that + and - operators must be surrounded by whitespace. This lets us detect each of the five tokens in -1.23e+45 + -1.23e+45 - -1.23e+45 using a simple regular expression. Spec: https://www.w3.org/TR/css3-values/#calc-syntax resolves web-animations#74
ewilligers
pushed a commit
to ewilligers/web-animations-js
that referenced
this issue
Jul 18, 2017
We no longer rely on 'eval'. Instead, we parse the calc expression and compute the value. We take advantage of the requirement that + and - operators must be surrounded by whitespace. This lets us detect each of the five tokens in -1.23e+45 + -1.23e+45 - -1.23e+45 using a simple regular expression. Spec: https://www.w3.org/TR/css3-values/#calc-syntax resolves web-animations#74
ewilligers
pushed a commit
to ewilligers/web-animations-js
that referenced
this issue
Jul 19, 2017
We no longer rely on 'eval'. Instead, we parse the calc expression and compute the value. We take advantage of the requirement that + and - operators must be surrounded by whitespace. This lets us detect each of the five tokens in -1.23e+45 + -1.23e+45 - -1.23e+45 using a simple regular expression. Spec: https://www.w3.org/TR/css3-values/#calc-syntax resolves web-animations#74
ewilligers
pushed a commit
to Motion-Path-Polyfill/web-animations-js
that referenced
this issue
Jul 21, 2017
We no longer rely on 'eval'. Instead, we parse the calc expression and compute the value. We take advantage of the requirement that + and - operators must be surrounded by whitespace. This lets us detect each of the five tokens in -1.23e+45 + -1.23e+45 - -1.23e+45 using a simple regular expression. Spec: https://www.w3.org/TR/css3-values/#calc-syntax resolves web-animations#74
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The dimension-handler.js code uses eval(). Is there anyway other it can be implemented? It prevents use of script-src 'unsafe-eval' as part of a Content-Security-Policy.
I found this in a polymer application that is deployed in an iOS WKWebView. The paper-drop-down menu animates something using this polyfill and it breaks badly due to the eval() failing as a result of an 'unsafe-eval' policy setting. It's a shame to have to remove 'unsafe-eval' just for sake of animation. I'd be okay with a slower animation if that's the trade off.
The text was updated successfully, but these errors were encountered: