huggingface / huggingface/transformers.js
Security issue - content security policy - script unsafe-eval
- Dominant language
- JavaScript
- Stars
- 16.3k
- Forks
- 1.2k
- Avg merge
- 6d 2h
- Merged PRs (30d)
- 6
Description
Context:
I use @xenova/transformers 2.6.2 npm package from a web application to do image classifcations. Here is the gist of my setup:
```js
const modelPath = 'own-domain/models-and-wasm/'
env.localModelPath = "/";
env.useBrowserCache = true;
env.backends.onnx.wasm.wasmPaths = modelPath;
const classifier = await pipeline("image-classification", modelPath, { quantized: true });
const output = await classifier(imagePath, { topk: 5 });
```
Everything works code-wise but when I remove unsafe-inline in CSP, it fails with this warning in the browser console:
```js
Failed to asynchronously prepare wasm:
CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive
```
I **cannot** allow script-src: unsafe-eval in my web application (corporate rules). Do I have any alternatives?
Contributor guide
Assessment
This issue has not been assessed yet.