Content Security Policy: eval blocked

[scola84]

In Firefox 63+ (Ubuntu and Windows) and Edge I get errors like

Content Security Policy: The page’s settings blocked the loading of a resource at eval (“default-src”).

Is it possible to solve this in v2? Could you put the saveAs function in a seperate file in src? Then I can bypass the attachment of the function to global.

[jimmywarting]

I was hoping to avoid this with a try/catch

The affected part is this:

FileSaver.js/dist/FileSaver.js

Lines 27 to 36 in 0018309

	var _global = function () {
	// some use content security policy to disable eval
	try {
	return Function('return this')() || (42, eval)('this');
	} catch (e) {
	// every global should have circular reference
	// used for checking if someone writes var window = {}; var self = {}
	return typeof window === 'object' && window.window === window ? window : typeof self === 'object' && self.self === self ? self : typeof global === 'object' && global.global === global ? global : this;
	}
	}();

[scola84]

Yeah, I understood from the comment. I don't know how old that part of the answer from Stackoverflow is, but apparently some browser have become even stricter. I'm currently trying some magic with Rollup to get rid of the definition of the global.

[WuglyakBolgoink]

same hier! Can reproduce in Firefox@63.0.1@windows, on MacOS Firefox show Error

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf eval blockiert ("script-src").

but content will be loaded correct.
Chrome@macos@latest - ok
yandexBrowser@macOS@latest - ok
Safari@macos@latest - ok
why this happen always at Friday?)

[WuglyakBolgoink]

up.

[scola84]

I solved it by replacing Function('return this')() || (42, eval)('this'); with window during the rollup building process.

Is this package ever used in any other context than the browser?

Anyway, I think you should export your core function in a separate file and attach it to any other context in specific files for those context. For me, this issue can be closed.

[jimmywarting]

FileSaver don't work in any other context but the window. But some includes it in web workers and nodejs for some reason

The solution would be to just remove the try and only use the cache method

 var _global = typeof window === 'object' && window.window === window 
  ? window : typeof self === 'object' && self.self === self 
  ? self : typeof global === 'object' && global.global === global 
  ? global 
  : this;

[jimmywarting]

released as v2.0.0