Description:
When loading the library, the browser throws an error:
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source
of script in the following Content Security Policy directive: "script-src 'self' [...]"
Looking into the stack trace, I see these lines from https://github.com/aframevr/aframe/blob/master/dist/aframe-master.js
//getters for the private vars
;['width', 'height',
'descender', 'ascender',
'xHeight', 'baseline',
'capHeight',
'lineHeight' ].forEach(addGetter)
function addGetter(name) {
Object.defineProperty(TextLayout.prototype, name, {
get: wrapper(name),
configurable: true
})
}
//create lookups for private vars
function wrapper(name) {
return (new Function([
'return function '+name+'() {',
' return this._'+name,
'}'
].join('\n')))()
}Looks like aframe requires unsafe-eval to be allowed which is quite dangerous. Is there a workaround to use aframe without enabling unsafe-eval??
Can this be replaced by something safer? like:
get: function () {
return this['_'+name]
},
- A-Frame Version: 1.3.0
- Platform / Device: PC / Chrome
- Reproducible Code Snippet or URL:
Thanks!
Description:
When loading the library, the browser throws an error:
Looking into the stack trace, I see these lines from https://github.com/aframevr/aframe/blob/master/dist/aframe-master.js
Looks like aframe requires unsafe-eval to be allowed which is quite dangerous. Is there a workaround to use aframe without enabling
unsafe-eval??Can this be replaced by something safer? like:
Thanks!