search

BorisMoore / jsrender

A lightweight, powerful and highly extensible templating engine. In the browser or on Node.js, with or without jQuery.
http://www.jsviews.com
MIT License
2.67k stars 339 forks source link

Chrome Extension Manifest V3 #368

Closed thao33 closed 2 years ago

thao33 commented 2 years ago

We are using jsrender for Chrome Extension and now migrating from manifest v2 to v3.

But, I got a problem with jsrender which be defined at content_scripts.

 Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Seem like source code of jsrender are using eval which is not allowed at manifest v3. Do you have a plan for supporting that?

BorisMoore commented 2 years ago

There is no plan for any specific changes to address v3 Chrome Extensions. But I have not tested using JsRender within a Chrome Extension. If I have time I may try to investigate that scenario, but it may take a while. Meantime, if you are able to explore that issue further, and come up with any additional thoughts or data, please post them here... Thanks...

BorisMoore commented 2 years ago

It may be possible to provide a new feature to pre compile a JsRender template. If the precompiled template is loaded before calling the jsrender templates() method, then eval (new Function) will not be called, and the code will work in the Chrome Extension, manifest V3.

But I'm not sure yet whether/when this precompile feature will be available...

BorisMoore commented 2 years ago

We won't be able to provide this precompile feature for now, although we may reconsider it in the future... See also here.

Closing this issue for now,