eclipsesource / eclipsesource/jsonforms
Ajv loading requires `unsafe-eval` policy for `script-src` Content-Security-Policy
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 424
- Avg merge
- 17d 8h
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
For secure environments, the content security policy requires the `unsafe-eval` policy directive for the `script-src` policy. This requirement is primarily due to the use of Ajv's use of the `Function` constructor per https://github.com/epoberezkin/ajv/issues/406
**Describe the solution you'd like**
The best resolution to this is to enable pre-compilation of the JSON schemas so that they don't have to be compiled at runtime. This can be accomplished using `ajv-pack` https://github.com/epoberezkin/ajv-pack
**Describe alternatives you've considered**
Alternatives or workarounds is to lazy load the Ajv validator so that it only loads when JsonForms components are rendered. This would allow compiling a version that disables jsonforms for environment with strict CSP's.
**Describe for which setup you like to have the improvement**
Framework: Material-UI (or any of the others, this should apply)
**Additional context**
See screen shots below for some examples of this error


Contributor guide
Assessment
This issue has not been assessed yet.