Backend is using `eval` which is incompatible with CSP
Open
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.6k
- Forks
- 705
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 134
Description
Description
It seems the backend is loading frabric.js, which is using eval. In order for one to apply a CSP, they need to use 'unsafe-eval which sort of beats the point IMO.
Steps to reproduce
- Visit the dashboard with a CSP applied without
'unsafe-eval' - Enjoy the console errors
If you guys want to reproduce this, you can try using @april's laboratory extension and you will see this:
Additional info
- Craft version: 3.0.16.1
- PHP version: 7.2
- Database driver & version: N/A
- Plugins & versions: N/A
There is an open issue on https://github.com/fabricjs/fabric.js/issues/1621 since 2014.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.