CSP compatibility

[rictic]

Currently, nyc instrument index.js grabs the global object with (Function('return this'))(), but since that's technically evalling a string, that throws an error when run with some CSP configs.

The use case we have is that we're moving towards running all of our tests with trusted types enforced, so that we can catch some insecure coding practices when tests run. While we could turn this off when coverage is enabled, if it's an easy fix it seems better and more robust for the coverage configuration to be as similar as possible to the normal test configuration.

Locally I've patched istanbul to instead do:

typeof globalThis === 'undefined' ? (Function('return this'))() : globalThis;

And that seems to work well

[himself65]

any update?

[SimenB]

https://github.com/istanbuljs/istanbuljs/releases/tag/istanbul-lib-instrument-v6.0.1

[himself65]

Thank u so much