dijit/form/_FormSelectWidget:getOptions breaks without CSP unsafe-eval
Open
- Dominant language
- HTML
- Stars
- 172
- Forks
- 180
- PR merge metrics
- No merged PRs in 30d
Description
The `getOptions` function in 1.16.3 contains the following snippet:
```
if(lang.isArrayLike(valueOrIdx)){
return array.map(valueOrIdx, "return this.getOptions(item);", this); // __SelectOption[]
}
```
By providing a string for the callback value, the array module then attempts to create a Function from the string. This fails when unsafe-eval is not allowed by the content-security-policy and could be rewritten to pass a function instead of a string e.g.
```
return array.map(valueOrIdx, (item) => this.getOptions(item), this); // __SelectOption[]
```
Contributor guide
Assessment
This issue has not been assessed yet.