eclipsesource / eclipsesource/jsonforms

Ajv loading requires `unsafe-eval` policy for `script-src` Content-Security-Policy

Open
#1,498 34 comments 9 reactions 0 assignees View on GitHub
core effort/high enhancement
Dominant language
TypeScript
Stars
2.7k
Forks
424
Avg merge
17d 8h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
For secure environments, the content security policy requires the `unsafe-eval` policy directive for the `script-src` policy. This requirement is primarily due to the use of Ajv's use of the `Function` constructor per https://github.com/epoberezkin/ajv/issues/406

**Describe the solution you'd like**
The best resolution to this is to enable pre-compilation of the JSON schemas so that they don't have to be compiled at runtime. This can be accomplished using `ajv-pack` https://github.com/epoberezkin/ajv-pack

**Describe alternatives you've considered**
Alternatives or workarounds is to lazy load the Ajv validator so that it only loads when JsonForms components are rendered. This would allow compiling a version that disables jsonforms for environment with strict CSP's.

**Describe for which setup you like to have the improvement**
Framework: Material-UI (or any of the others, this should apply)

**Additional context**
See screen shots below for some examples of this error
Screen Shot 2019-09-09 at 9 13 50 AM

Screen Shot 2019-09-09 at 8 57 42 AM

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.