Content Security Policy (CSP) blocks eval()

[akhaneev]

This is an improvement request to replace the eval() function to make it CSP compatible.

[mathiasrw]

AlaSQL will never be CSP compatible. But we might work towards being able to export compiled functions so you can include it in your code. But it aint pretty.

[githorse]

I <3 Alasql! But I just shot myself in the foot by baking it into my new feature without realizing this CSP issue. Now we can't deploy it to production and I'm probably going to have to strip it out and look for a replacement. A few thoughts / questions:

• (for the community) - Is this not a deal-breaking issue for most people, at least as far as deploying Alasql in production app? Does this not break all security audits (ISO, SOC, etc.?) How do people work around this in the wild?
• (for the community) - What's the next best alternative I can use that doesn't have this limitation?
• (for Alasql maintainers) - Is the eval baked in to every part of Alasql, or might it be possible to support some simpler subset of SQL without it? (For instance, my use case doesn't use any joins, though I do need GROUP BY.)

[mathiasrw]

Does this not break all security audits (ISO, SOC, etc.?)

There is nothing in any security audit that prevents you from running JS that generates gode (use eval or new Function). The key is that you must show that you got the proper controls in place to avoid having arbitrary code running client side. Asking the browser to block it is one way to protect your self. But you can document this in other ways for your security report.

What's the next best alternative I can use that doesn't have this limitation?

You can just have the data server side and run queries server side - like normal. I guess today you can also get away with wrapping SQLite in a webworker and throw data and queries back and forth.

What's the next best alternative I can use that doesn't have this limitation?

Yes, its in every part of executing a query. AlaSQL works by taking a SQL string, and then create the string of the JS function that should run for you to get the correct result. Its basically just generating gode for you.

---

Please consider using https://github.com/AlaSQL/alasql/discussions for things like this.