Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No longer able to use script in Chrome extension after upgrade from v6.0.13 to v8.1.0 #278

Closed
randombk opened this issue Jul 5, 2019 · 1 comment

Comments

@randombk
Copy link

randombk commented Jul 5, 2019

After upgrading the library from v6.0.13 to v8.1.0, attempting to use the library in a Chrome extension results in the following error:

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:".

    at Object../lib/ReactCrop.js (ReactCrop.js:107)
    at __webpack_require__ (ReactCrop.js:30)
    at ReactCrop.js:94
    at ReactCrop.js:97
    at webpackUniversalModuleDefinition (ReactCrop.js:3)
    at Object../node_modules/react-image-crop/dist/ReactCrop.js (ReactCrop.js:10)
    at __webpack_require__ (bootstrap:19)

Updating extension manifest to "content_security_policy": "script-src 'self' 'unsafe-eval' blob: filesystem: chrome-extension-resource:; object-src 'self'" serves as a temporary work-around, but is not suitable for long-term use due to security concerns.

@sekoyo
Copy link
Owner

sekoyo commented Jul 5, 2019

I will update the package "main" entry to the min version which doesn't have eval() sourcemaps.

For now you can require the min version directly - 'react-image-crop/dist/ReactCrop.min'

@sekoyo sekoyo closed this as completed in 6b6c7e0 Jul 28, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants