ELEMENTS-1759: Remove usage of unsafe-eval from CSP

nuxeo · Oct 17, 2024 · c2e94ad · c2e94ad
1 parent 78fcbbe
commit c2e94ad
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 25 deletions.
diff --git a/ui/nuxeo-filter.js b/ui/nuxeo-filter.js
@@ -18,7 +18,6 @@ limitations under the License.
 import '@polymer/polymer/polymer-legacy.js';
 
 import '@nuxeo/nuxeo-elements/nuxeo-element.js';
-import { config } from '@nuxeo/nuxeo-elements';
 import { Debouncer } from '@polymer/polymer/lib/utils/debounce.js';
 import { microTask } from '@polymer/polymer/lib/utils/async.js';
 import { enqueueDebouncer } from '@polymer/polymer/lib/utils/flush.js';
@@ -185,29 +184,25 @@ import Interpreter from './js-interpreter/interpreter.js';
       let res = false;
 
       try {
-        if (!config.get('expressions.eval', true)) {
-          const js = new Interpreter(expression, (interpreter, scope) => {
-            // set scope
-            interpreter.setProperty(scope, 'this', interpreter.nativeToPseudo(FiltersBehavior));
-            Object.entries({ document, user }).forEach(([k, obj]) => {
-              const v = {};
-              // filter out private properties
-              Object.getOwnPropertyNames(obj)
-                .filter((p) => !p.startsWith('_'))
-                .forEach((p) => {
-                  v[p] = obj[p];
-                });
-              interpreter.setProperty(scope, k, interpreter.nativeToPseudo(v));
-            });
-            // XXX: 'this' in the scope of native functions is the interpreter instance
-            Object.assign(interpreter, FiltersBehavior);
+        const js = new Interpreter(expression, (interpreter, scope) => {
+          // set scope
+          interpreter.setProperty(scope, 'this', interpreter.nativeToPseudo(FiltersBehavior));
+          Object.entries({ document, user }).forEach(([k, obj]) => {
+            const v = {};
+            // filter out private properties
+            Object.getOwnPropertyNames(obj)
+              .filter((p) => !p.startsWith('_'))
+              .forEach((p) => {
+                v[p] = obj[p];
+              });
+            interpreter.setProperty(scope, k, interpreter.nativeToPseudo(v));
           });
-          js.run();
-          res = js.value;
-        } else {
-          const fn = new Function(['document', 'user'], `return ${expression};`);
-          res = fn.apply(this, [document, user]);
-        }
+          // XXX: 'this' in the scope of native functions is the interpreter instance
+          Object.assign(interpreter, FiltersBehavior);
+        });
+        js.run();
+        res = js.value;
+
         return res;
       } catch (err) {
         console.error(`${err} in <nuxeo-filter> expression "${expression}"`);

diff --git a/ui/viewers/pdfjs/web/viewer.html b/ui/viewers/pdfjs/web/viewer.html
@@ -29,11 +29,11 @@
 
 <!-- This snippet is used in production (included from viewer.html) -->
 <link rel="resource" type="application/l10n" href="locale/locale.json">
-<script src="../build/pdf.mjs" type="module"></script>
+<script src="../build/pdf.mjs" type="module"  nonce="dummy"></script>
 
     <link rel="stylesheet" href="viewer.css">
 
-  <script src="viewer.mjs" type="module"></script>
+  <script src="viewer.mjs" type="module"  nonce="dummy"></script>
   </head>
 
   <body tabindex="1">