react / react/yoga

Request to Remove or Address `unsafe-eval` Usage in Yoga Layout

Open
#1,767 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
18.9k
Forks
1.6k
Avg merge
1m
Merged PRs (30d)
1

Description

Hi Yoga Layout Team,

I am currently using @react-pdf/renderer (version ^4.1.5) in my project, which depends on yoga-layout. During development, I've encountered issues related to the usage of unsafe-eval within yoga-layout.

Problem

The inclusion of unsafe-eval poses significant security risks and violates stricter Content Security Policies (CSPs), which are becoming increasingly common in modern web applications. This makes it challenging to use yoga-layout in secure environments without relaxing CSP rules, which isn't always an acceptable solution.

Steps to Reproduce
  1. Integrate @react-pdf/renderer (which uses yoga-layout) into a project.
  2. Implement a CSP policy that disallows unsafe-eval.
  3. Observe the resulting errors when attempting to use yoga-layout.

Let me know if additional details, examples, or assistance with refactoring would be helpful. Thank you for all the effort you’ve put into maintaining this essential library!

Best regards,
Michele

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating how yoga-layout is included and where its unsafe-eval usage is introduced; the issue does not name a file or test. Reproduce the integration with a CSP that disallows unsafe-eval, then verify that yoga-layout works without requiring that policy exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, react
Domain
security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.