huggingface / huggingface/transformers.js

Security issue - content security policy - script unsafe-eval

Open
#378 4 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
JavaScript
Stars
16.3k
Forks
1.2k
Avg merge
6d 2h
Merged PRs (30d)
6

Description

Context:
I use @xenova/transformers 2.6.2 npm package from a web application to do image classifcations. Here is the gist of my setup:

```js
const modelPath = 'own-domain/models-and-wasm/'

env.localModelPath = "/";
env.useBrowserCache = true;
env.backends.onnx.wasm.wasmPaths = modelPath;

const classifier = await pipeline("image-classification", modelPath, { quantized: true });
const output = await classifier(imagePath, { topk: 5 });
```

Everything works code-wise but when I remove unsafe-inline in CSP, it fails with this warning in the browser console:

```js
Failed to asynchronously prepare wasm:
CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive
```

I **cannot** allow script-src: unsafe-eval in my web application (corporate rules). Do I have any alternatives?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.