BuilderIO / BuilderIO/builder

Using `eval` for detecting server code throws CSP error

Open
#4,212 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
8.8k
Forks
1.2k
Avg merge
1d 6h
Merged PRs (30d)
17

Description

Import `@builder.io/react` version 8.2.9 to main index.js and just render it on a browser throws
`Content Security Policy of your site blocks the use of 'eval' in JavaScript`
even if we are not using any of the builder code and just import the builder module.

the callstack point on this
```
try {
serverOnlyRequire = eval("require")
} catch (e) {
serverOnlyRequire = function() {
return null
}
}
```
which is using eval for checking if this is server only instead of checking window is undefined first.

Can you fix it please ?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by importing @builder.io/react 8.2.9 from main index.js in a browser with a Content Security Policy that blocks eval, then trace the reported serverOnlyRequire snippet. Done means the import renders without triggering the CSP error when no Builder code is used.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.