{"action":"created","issue":{"url":"https://api.github.com/repos/Hopding/pdf-lib/issues/13","repository_url":"https://api.github.com/repos/Hopding/pdf-lib","labels_url":"https://api.github.com/repos/Hopding/pdf-lib/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/Hopding/pdf-lib/issues/13/comments","events_url":"https://api.github.com/repos/Hopding/pdf-lib/issues/13/events","html_url":"https://github.com/Hopding/pdf-lib/issues/13","id":339137082,"node_id":"MDU6SXNzdWUzMzkxMzcwODI=","number":13,"title":"Please adapt for Content Security Policy: drop Function(string), if possible (eval)","user":{"login":"vitaly-zdanevich","id":3514015,"node_id":"MDQ6VXNlcjM1MTQwMTU=","avatar_url":"https://avatars2.githubusercontent.com/u/3514015?v=4","gravatar_id":"","url":"https://api.github.com/users/vitaly-zdanevich","html_url":"https://github.com/vitaly-zdanevich","followers_url":"https://api.github.com/users/vitaly-zdanevich/followers","following_url":"https://api.github.com/users/vitaly-zdanevich/following{/other_user}","gists_url":"https://api.github.com/users/vitaly-zdanevich/gists{/gist_id}","starred_url":"https://api.github.com/users/vitaly-zdanevich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vitaly-zdanevich/subscriptions","organizations_url":"https://api.github.com/users/vitaly-zdanevich/orgs","repos_url":"https://api.github.com/users/vitaly-zdanevich/repos","events_url":"https://api.github.com/users/vitaly-zdanevich/events{/privacy}","received_events_url":"https://api.github.com/users/vitaly-zdanevich/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-07T10:56:55Z","updated_at":"2018-07-15T13:46:26Z","closed_at":null,"author_association":"NONE","body":"For example file\r\nhttps://unpkg.com/pdf-lib/dist/pdf-lib.js\r\nLine 30:\r\n`var root = _freeGlobal || freeSelf || Function('return this')();`\r\n\r\nBecause of `Function('return this')` Chrome with CSP cannot execute this lib:\r\n`Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed`\r\n\r\nMore information about CSP here https://developer.chrome.com/extensions/contentSecurityPolicy"},"comment":{"url":"https://api.github.com/repos/Hopding/pdf-lib/issues/comments/405093198","html_url":"https://github.com/Hopding/pdf-lib/issues/13#issuecomment-405093198","issue_url":"https://api.github.com/repos/Hopding/pdf-lib/issues/13","id":405093198,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNTA5MzE5OA==","user":{"login":"Hopding","id":10351828,"node_id":"MDQ6VXNlcjEwMzUxODI4","avatar_url":"https://avatars0.githubusercontent.com/u/10351828?v=4","gravatar_id":"","url":"https://api.github.com/users/Hopding","html_url":"https://github.com/Hopding","followers_url":"https://api.github.com/users/Hopding/followers","following_url":"https://api.github.com/users/Hopding/following{/other_user}","gists_url":"https://api.github.com/users/Hopding/gists{/gist_id}","starred_url":"https://api.github.com/users/Hopding/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Hopding/subscriptions","organizations_url":"https://api.github.com/users/Hopding/orgs","repos_url":"https://api.github.com/users/Hopding/repos","events_url":"https://api.github.com/users/Hopding/events{/privacy}","received_events_url":"https://api.github.com/users/Hopding/received_events","type":"User","site_admin":false},"created_at":"2018-07-15T13:46:26Z","updated_at":"2018-07-15T13:46:26Z","author_association":"OWNER","body":"I believe I've found the cause of the issue. I've created a minimal example that reproduces it:\r\n\r\n[rollup-test.zip](https://github.com/Hopding/pdf-lib/files/2195741/rollup-test.zip)\r\n\r\nYou can unzip this example and run `npm install && npm run-script build` to create the `bundle.js` file with `rollup`. You'll see that the bundle looks like the following:\r\n```javascript\r\n(function (global, factory) {\r\n\ttypeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :\r\n\ttypeof define === 'function' && define.amd ? define(['exports'], factory) :\r\n\t(factory((global.Foo = {})));\r\n}(this, (function (exports) { 'use strict';\r\n\r\n\tvar commonjsGlobal = typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};\r\n\r\n\t/** Detect free variable `global` from Node.js. */\r\n\tvar freeGlobal = typeof commonjsGlobal == 'object' && commonjsGlobal && commonjsGlobal.Object === Object && commonjsGlobal;\r\n\r\n\tvar _freeGlobal = freeGlobal;\r\n\r\n\t/** Detect free variable `self`. */\r\n\tvar freeSelf = typeof self == 'object' && self && self.Object === Object && self;\r\n\r\n\t/** Used as a reference to the global object. */\r\n\tvar root = _freeGlobal || freeSelf || Function('return this')();\r\n```\r\nThe cause of this seems to be importing a function directly from lodash, e.g. in the `foo.js` file of this example:\r\n```javascript\r\n// This type of import from lodash seems to be the cause:\r\nimport isString from 'lodash/isString';\r\n\r\nexport const foo = (x) => {\r\n  console.log(isString(x));\r\n};\r\n```\r\nI'm going to try some things to fix this. First on the list is replacing the plain `lodash` module with `lodash-es`."}}
{"actor":{"display_login":"Hopding"}}