CSP violations due to use of new Function()

[nealedj]

It looks like new Function() is used here

It appears to be handled within the try/catch but it still raises a CSP violation in the browser.

It'd be most excellent if there was a setting where this could be disabled and the fallback behaviour was always used. I see that this was suggested in this issue.

Thanks!

[jmdobry]

Hmm, I didn't know new Function() would do this. Your link to the issue is the same as the link to the code.

[nealedj]

Ah sorry - have updated to the actual issue (js-data/js-data-angular#242)

[jmdobry]

My proposed fix is to add a flag that forces the library to not execute the code that raises the CSP violation warning. Is that sufficient?

[jmdobry]

@nealedj Thoughts?

[nealedj]

Sorry @jmdobry - was going to give that a test today but haven't got round to it yet.

The fix looks perfect though.

[nealedj]

Just to follow up - tested this and it works great. Thanks!