Commits on Aug 10, 2023

1. Allow "wasm-unsafe-eval" in CSP …

   If a page has a Content Security Policy header and the `script-src` (or
   `default-src`) directive does not contain neither `wasm-unsafe-eval` nor
   `unsafe-eval` loading and executing WebAssembly is blocked in the page
   (although it is still possible to load and execute WebAssembly in a
   worker thread).
   
   Although the Nextcloud classes to manage the CSP already supported
   allowing `unsafe-eval` this affects not only WebAssembly, but also the
   `eval` operation in JavaScript.
   
   To make possible to allow WebAssembly execution without allowing
   JavaScript `eval` this commit adds support for allowing
   `wasm-unsafe-eval`.
   
   Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>

   

   danxuliu committed Aug 10, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 41f2d91
   • Browse repository at this point

   Copy the full SHA

   41f2d91 View commit details

   Browse the repository at this point in the history