Javascript "Unsafe Eval" Chrome Webapps

[nate-zimmerman]

When attempting to use "math.js" in any chrome app the following appears:
"
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self' blob: filesystem: chrome-extension-resource:".
"
The line(1715 ) it errors at is here(in non-compiled version):
" var factory = (new Function(refs.name, 'createError', body)); "
Any idea what it might take to get math.js to work in chrome webapps?

[nate-zimmerman]

Been doing abit more digging. Apparently the "new Function" can be a security vulnerability so chrome apps does not allow it. :(
https://developer.chrome.com/extensions/contentSecurityPolicy

[josdejong]

math.js deeply relies on evaluating JavaScript on the fly, this gives it it's flexibility of working with different data types and automatically converting them, and gives quite a performance boost for example for parsing and evaluating expressions.

On the page you mention there is a section Relaxing the default policy

Evaluated JavaScript
The policy against eval() and its relatives like setTimeout(String), setInterval(String), and new Function(String) can be relaxed by adding 'unsafe-eval' to your policy:

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

However, we strongly recommend against doing this. These functions are notorious XSS attack vectors.

Did you give that a try?

[nate-zimmerman]

Many thanks for your reply. Yes, that was the first thing I tried though regretfully that only applies to extensions, not apps. Regretfully I am using chrome apps.

When you combine systems like node js or chrome apps that have access to your full file system + on the fly java-script parsing, apparently it can make for some nasty exploits which is why chrome atleast blocks it.

[ORESoftware]

I dont know about other people, but I can't get it to work Chrome Extensions, let alone Chrome Apps.

[josdejong]

I haven't tried that, so I'm not sure.

Just as a side note: Chrome Apps will become deprecated soon, so I guess it's better not spend effort in creating a new Chrome app.

[ORESoftware]

@josdejong thanks, yeah I am creating an extension, not an app, so should be safe

using the following in manifest.json actually worked for me:

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

[josdejong]

Good to hear you have a working solution now! Looks like the solution I quoted earlier in this topic (#559 (comment)) still works then after all.