{"action":"created","issue":{"url":"https://api.github.com/repos/octobercms/october/issues/3608","repository_url":"https://api.github.com/repos/octobercms/october","labels_url":"https://api.github.com/repos/octobercms/october/issues/3608/labels{/name}","comments_url":"https://api.github.com/repos/octobercms/october/issues/3608/comments","events_url":"https://api.github.com/repos/octobercms/october/issues/3608/events","html_url":"https://github.com/octobercms/october/issues/3608","id":335324864,"node_id":"MDU6SXNzdWUzMzUzMjQ4NjQ=","number":3608,"title":"assets/js/framework.js forces the use of the 'unsafe-eval' Content-Security-Policy directive.","user":{"login":"MeLlamoPablo","id":11708035,"node_id":"MDQ6VXNlcjExNzA4MDM1","avatar_url":"https://avatars1.githubusercontent.com/u/11708035?v=4","gravatar_id":"","url":"https://api.github.com/users/MeLlamoPablo","html_url":"https://github.com/MeLlamoPablo","followers_url":"https://api.github.com/users/MeLlamoPablo/followers","following_url":"https://api.github.com/users/MeLlamoPablo/following{/other_user}","gists_url":"https://api.github.com/users/MeLlamoPablo/gists{/gist_id}","starred_url":"https://api.github.com/users/MeLlamoPablo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MeLlamoPablo/subscriptions","organizations_url":"https://api.github.com/users/MeLlamoPablo/orgs","repos_url":"https://api.github.com/users/MeLlamoPablo/repos","events_url":"https://api.github.com/users/MeLlamoPablo/events{/privacy}","received_events_url":"https://api.github.com/users/MeLlamoPablo/received_events","type":"User","site_admin":false},"labels":[{"id":330615855,"node_id":"MDU6TGFiZWwzMzA2MTU4NTU=","url":"https://api.github.com/repos/octobercms/october/labels/Priority:%20Low","name":"Priority: Low","color":"009800","default":false},{"id":330614802,"node_id":"MDU6TGFiZWwzMzA2MTQ4MDI=","url":"https://api.github.com/repos/octobercms/october/labels/Status:%20Accepted","name":"Status: Accepted","color":"009800","default":false},{"id":330614039,"node_id":"MDU6TGFiZWwzMzA2MTQwMzk=","url":"https://api.github.com/repos/octobercms/october/labels/Type:%20Maintenance","name":"Type: Maintenance","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"daftspunk","id":1392869,"node_id":"MDQ6VXNlcjEzOTI4Njk=","avatar_url":"https://avatars1.githubusercontent.com/u/1392869?v=4","gravatar_id":"","url":"https://api.github.com/users/daftspunk","html_url":"https://github.com/daftspunk","followers_url":"https://api.github.com/users/daftspunk/followers","following_url":"https://api.github.com/users/daftspunk/following{/other_user}","gists_url":"https://api.github.com/users/daftspunk/gists{/gist_id}","starred_url":"https://api.github.com/users/daftspunk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daftspunk/subscriptions","organizations_url":"https://api.github.com/users/daftspunk/orgs","repos_url":"https://api.github.com/users/daftspunk/repos","events_url":"https://api.github.com/users/daftspunk/events{/privacy}","received_events_url":"https://api.github.com/users/daftspunk/received_events","type":"User","site_admin":false},"assignees":[{"login":"daftspunk","id":1392869,"node_id":"MDQ6VXNlcjEzOTI4Njk=","avatar_url":"https://avatars1.githubusercontent.com/u/1392869?v=4","gravatar_id":"","url":"https://api.github.com/users/daftspunk","html_url":"https://github.com/daftspunk","followers_url":"https://api.github.com/users/daftspunk/followers","following_url":"https://api.github.com/users/daftspunk/following{/other_user}","gists_url":"https://api.github.com/users/daftspunk/gists{/gist_id}","starred_url":"https://api.github.com/users/daftspunk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daftspunk/subscriptions","organizations_url":"https://api.github.com/users/daftspunk/orgs","repos_url":"https://api.github.com/users/daftspunk/repos","events_url":"https://api.github.com/users/daftspunk/events{/privacy}","received_events_url":"https://api.github.com/users/daftspunk/received_events","type":"User","site_admin":false}],"milestone":null,"comments":17,"created_at":"2018-06-25T09:20:09Z","updated_at":"2018-10-16T16:41:51Z","closed_at":null,"author_association":"NONE","body":"##### Expected behavior\r\nThe OctoberCMS backend works with the following [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP):\r\n\r\n```\r\ndefault-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';\r\n```\r\n\r\n##### Actual behavior\r\nThe OctoberCMS backend crashes because the code violates the previous Content-Security-Policy. Here is the error:\r\n\r\n```\r\nUncaught Error: Error parsing the data-request-update attribute value. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"script-src 'self' 'unsafe-inline' data: connect.facebook.net sdk.accountkit.com www.google-analytics.com\".\r\n    at paramToObj (framework.js?v1:459)\r\n    at n.fn.init.$.fn.request (framework.js?v1:426)\r\n    at Function.$.request (framework.js?v1:437)\r\n    at HTMLDocument.<anonymous> (backend:238)\r\n    at j (jquery.min.js?v1:2)\r\n    at Object.fireWith [as resolveWith] (jquery.min.js?v1:2)\r\n    at Function.ready (jquery.min.js?v1:2)\r\n    at HTMLDocument.I (jquery.min.js?v1:2)\r\n```\r\n\r\nThe error is produced at exactly [this line in assets/js/framework.js](https://github.com/octobercms/october/blob/5ee8ee09170fa52cd6bb5dbb2416345aeea186e5/modules/system/assets/js/framework.js#L459).\r\n\r\nThis error doesn't occur when including 'unsafe-eval' in the CSP header, like so:\r\n\r\n```\r\ndefault-src 'none'; script-src 'self' 'unsafe-eval'; connect-src 'self'; img-src 'self'; style-src 'self';\r\n```\r\n\r\nThis error occurs because `eval` is used to parse arbitrary JSON data from the client, I presume. I don't understand the reasoning for using `eval > stringify > parse`, as I believe that simply `parse` should be enough, and that would fix this issue.\r\n\r\n##### Reproduce steps\r\n\r\n1. Create a fresh OctoberCMS install.\r\n2. Put it behind an NGINX reverse proxy.\r\n3. Add the following directive to the NGINX configuration:\r\n    ```\r\n    add_header Content-Security-Policy  \"default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';\" always;\r\n    ```\r\n4. Navigate to `https://my-site.test/backend`, and log in\r\n\r\n##### October build\r\nv1.0.435"},"comment":{"url":"https://api.github.com/repos/octobercms/october/issues/comments/430309586","html_url":"https://github.com/octobercms/october/issues/3608#issuecomment-430309586","issue_url":"https://api.github.com/repos/octobercms/october/issues/3608","id":430309586,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDMwOTU4Ng==","user":{"login":"nathan-van-der-werf","id":1123054,"node_id":"MDQ6VXNlcjExMjMwNTQ=","avatar_url":"https://avatars3.githubusercontent.com/u/1123054?v=4","gravatar_id":"","url":"https://api.github.com/users/nathan-van-der-werf","html_url":"https://github.com/nathan-van-der-werf","followers_url":"https://api.github.com/users/nathan-van-der-werf/followers","following_url":"https://api.github.com/users/nathan-van-der-werf/following{/other_user}","gists_url":"https://api.github.com/users/nathan-van-der-werf/gists{/gist_id}","starred_url":"https://api.github.com/users/nathan-van-der-werf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathan-van-der-werf/subscriptions","organizations_url":"https://api.github.com/users/nathan-van-der-werf/orgs","repos_url":"https://api.github.com/users/nathan-van-der-werf/repos","events_url":"https://api.github.com/users/nathan-van-der-werf/events{/privacy}","received_events_url":"https://api.github.com/users/nathan-van-der-werf/received_events","type":"User","site_admin":false},"created_at":"2018-10-16T16:41:51Z","updated_at":"2018-10-16T16:41:51Z","author_association":"CONTRIBUTOR","body":"I agree with @ayumihamsaki that this is a big issue."}}
{"actor":{"display_login":"nathan-van-der-werf"}}