Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

unsafe-eval when using content-security-policy #35

Open
rafde opened this issue Nov 9, 2023 · 0 comments
Open

unsafe-eval when using content-security-policy #35

rafde opened this issue Nov 9, 2023 · 0 comments

Comments

@rafde
Copy link

rafde commented Nov 9, 2023

the following lines will produce unsafe-eval when using content-security-policy

https://github.com/ytiurin/downscale/blob/master/src/downscale.js#L14
https://github.com/ytiurin/downscale/blob/master/src/downscale.js#L20

The use of new Function is considered unsafe. I am not sure why this approach was taken, but my guess is there was a no-op function that was needed. I think the safer approach would be

function _noop(){}

function createTiming(enabled, source, destWidth, destHeight)
{
  var start  = new Date
  var timing = {}
  var prev   = start
  var n      = "01"

  return {
    mark: enabled ? function(name) {
      name = n + ". " + (name || "...")
      timing[name] = { "time (ms)": (new Date) - prev }
      prev = new Date
      n = ("0" + ((n >> 0) + 1)).substr(-2)
    } : _noop,
    finish: enabled ? function() {
      timing[n + " TOTAL"] = { "time (ms)": (new Date) - start }
      console.log("IMAGE SOURCE:", source)
      console.log("DOWNSCALE TO:", destWidth + "x" + destHeight)
      console.table(timing)
    } : _noop
  }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant