Remove unsafe-eval from CSP when Chrome supports worker CSP
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 142
- Forks
- 230
- PR merge metrics
- No merged PRs in 30d
Description
Once https://crbug.com/1253267 is fixed (estimated Chrome M97) and that Chrome release rolls out widely, we can remove `unsafe-eval` from our main HTML CSP, and keep it enabled only for the worker script. This should substantially improve the policy security, since only the Playground worker will be able to execute WASM or eval JS, but it won't be able to do hardly anything else (such as calling the new GitHub token exchange API).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking the Chrome issue for worker CSP support, then locate the main HTML CSP and the Playground worker script configuration. Done means unsafe-eval is removed from the main policy while remaining enabled only for the worker, after the required Chrome release is widely available.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100