{"action":"created","issue":{"url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/254","repository_url":"https://api.github.com/repos/ckeditor/ckeditor-dev","labels_url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/254/labels{/name}","comments_url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/254/comments","events_url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/254/events","html_url":"https://github.com/ckeditor/ckeditor-dev/pull/254","id":138289442,"number":254,"title":"fixes issue #8584: Support Content Security Policy","user":{"login":"caridy","id":38969,"avatar_url":"https://avatars.githubusercontent.com/u/38969?v=3","gravatar_id":"","url":"https://api.github.com/users/caridy","html_url":"https://github.com/caridy","followers_url":"https://api.github.com/users/caridy/followers","following_url":"https://api.github.com/users/caridy/following{/other_user}","gists_url":"https://api.github.com/users/caridy/gists{/gist_id}","starred_url":"https://api.github.com/users/caridy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caridy/subscriptions","organizations_url":"https://api.github.com/users/caridy/orgs","repos_url":"https://api.github.com/users/caridy/repos","events_url":"https://api.github.com/users/caridy/events{/privacy}","received_events_url":"https://api.github.com/users/caridy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ckeditor/ckeditor-dev/labels/tests%20needed","name":"tests needed","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2016-03-03T20:32:09Z","updated_at":"2016-03-22T08:43:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ckeditor/ckeditor-dev/pulls/254","html_url":"https://github.com/ckeditor/ckeditor-dev/pull/254","diff_url":"https://github.com/ckeditor/ckeditor-dev/pull/254.diff","patch_url":"https://github.com/ckeditor/ckeditor-dev/pull/254.patch"},"body":"The solutions that other popular libraries and frameworks are adopting to comply with CSP are:\r\n\r\n1) provide a hook consumers to bypass the indirect evaluation routine (doesn't apply to this case)\r\n\r\n2) provide a less performant solution that can be used under certain conditions.\r\n\r\nI have implemented the corresponding forking logic on `CKEDITOR.template` to detect whether or not indirect eval is available, and use an alternative `output` function that is less performant but works well with CSP.\r\n\r\nIt is very similar to what Angular does for their expression language, and it is a solution that can be ported back to any previous version of CKEditor that relies on the same CKEDITOR.template mechanism.  This solution can be backported to 4.x (I wasn't sure about the branching strategy on this repo)\r\n\r\nBy forcing to use the new less-performant solution (setting the `isIndirectEvalSupported` flag manually) we have validated that all tests are passing, but someone will have to do a little bit of work here to make sure that every template test runs with and without the flag.\r\n\r\nBackpointer: https://dev.ckeditor.com/ticket/8584\r\nSF Backpointer: @W-2958085"},"comment":{"url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/comments/199703147","html_url":"https://github.com/ckeditor/ckeditor-dev/pull/254#issuecomment-199703147","issue_url":"https://api.github.com/repos/ckeditor/ckeditor-dev/issues/254","id":199703147,"user":{"login":"mlewand","id":5353898,"avatar_url":"https://avatars.githubusercontent.com/u/5353898?v=3","gravatar_id":"","url":"https://api.github.com/users/mlewand","html_url":"https://github.com/mlewand","followers_url":"https://api.github.com/users/mlewand/followers","following_url":"https://api.github.com/users/mlewand/following{/other_user}","gists_url":"https://api.github.com/users/mlewand/gists{/gist_id}","starred_url":"https://api.github.com/users/mlewand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mlewand/subscriptions","organizations_url":"https://api.github.com/users/mlewand/orgs","repos_url":"https://api.github.com/users/mlewand/repos","events_url":"https://api.github.com/users/mlewand/events{/privacy}","received_events_url":"https://api.github.com/users/mlewand/received_events","type":"User","site_admin":false},"created_at":"2016-03-22T08:43:18Z","updated_at":"2016-03-22T08:43:18Z","body":"@caridy thanks for this analysis! Did you try to change alternative template building method to use regexp only as suggested in [comment 193732733](https://github.com/ckeditor/ckeditor-dev/pull/254#issuecomment-193732733) and [comment 193777360](https://github.com/ckeditor/ckeditor-dev/pull/254#issuecomment-193777360)? Assuming that replace regexp would be compiled only once, it might present much better performance.\r\n\r\nThat being said at the end we'll need also to do deeper profiling, as jsperf tests are not reliable as results might be distorted by browser optimization behind the scene, but no need to worry about this at this point yet."}}