Request to Remove or Address `unsafe-eval` Usage in Yoga Layout
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 18.9k
- Forks
- 1.6k
- Avg merge
- 1m
- Merged PRs (30d)
- 1
Description
Hi Yoga Layout Team,
I am currently using @react-pdf/renderer (version ^4.1.5) in my project, which depends on yoga-layout. During development, I've encountered issues related to the usage of unsafe-eval within yoga-layout.
Problem
The inclusion of unsafe-eval poses significant security risks and violates stricter Content Security Policies (CSPs), which are becoming increasingly common in modern web applications. This makes it challenging to use yoga-layout in secure environments without relaxing CSP rules, which isn't always an acceptable solution.
Steps to Reproduce
- Integrate
@react-pdf/renderer(which usesyoga-layout) into a project. - Implement a CSP policy that disallows
unsafe-eval. - Observe the resulting errors when attempting to use
yoga-layout.
Let me know if additional details, examples, or assistance with refactoring would be helpful. Thank you for all the effort you’ve put into maintaining this essential library!
Best regards,
Michele
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating how yoga-layout is included and where its unsafe-eval usage is introduced; the issue does not name a file or test. Reproduce the integration with a CSP that disallows unsafe-eval, then verify that yoga-layout works without requiring that policy exception.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, react
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100