Using `eval` for detecting server code throws CSP error
- Dominant language
- TypeScript
- Stars
- 8.8k
- Forks
- 1.2k
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 17
Description
Import `@builder.io/react` version 8.2.9 to main index.js and just render it on a browser throws
`Content Security Policy of your site blocks the use of 'eval' in JavaScript`
even if we are not using any of the builder code and just import the builder module.
the callstack point on this
```
try {
serverOnlyRequire = eval("require")
} catch (e) {
serverOnlyRequire = function() {
return null
}
}
```
which is using eval for checking if this is server only instead of checking window is undefined first.
Can you fix it please ?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by importing @builder.io/react 8.2.9 from main index.js in a browser with a Content Security Policy that blocks eval, then trace the reported serverOnlyRequire snippet. Done means the import renders without triggering the CSP error when no Builder code is used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100