dojo / dojo/dijit

dijit/form/_FormSelectWidget:getOptions breaks without CSP unsafe-eval

Open
#188 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
172
Forks
180
PR merge metrics
No merged PRs in 30d

Description

The `getOptions` function in 1.16.3 contains the following snippet:
```
if(lang.isArrayLike(valueOrIdx)){
return array.map(valueOrIdx, "return this.getOptions(item);", this); // __SelectOption[]
}
```

By providing a string for the callback value, the array module then attempts to create a Function from the string. This fails when unsafe-eval is not allowed by the content-security-policy and could be rewritten to pass a function instead of a string e.g.
```
return array.map(valueOrIdx, (item) => this.getOptions(item), this); // __SelectOption[]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.