Open danizep opened 1 year ago
Hi @danizep ! Sure, this might seem to be caused by Emscripten's generated code. We'll take a look and see if we can get rid of this. Cheers!
Any updates on this? We're in the middle of a pen test and I would like to remove 'unsafe-eval'
to get a better grade. If this is landing shortly, I can postpone a bit.
Hey, we will take care of this issues (and many of the rest) before the end of this year, but right now we can't commit to a more specific deadline. We are now scaling and getting funding so probably this will be different next year. Cheers!
Thanks for the quick reply, now it's all clear what to expect. Congrats on your funding!
Hello @danizep and @wwwouter We are testing possible solutions for this problem, but we must be able to reproduce it. Any ideas on how to enable this 'unsafe-eval' issue?
Does this help?
const http = require("http");
const host = "localhost";
const port = 8000;
const requestListener = function (req, res) {
// const headers = {
// "content-security-policy":
// "script-src 'self' 'unsafe-eval' ifcjs.github.io;",
// };
const headers = {
"content-security-policy": "script-src 'self' ifcjs.github.io;",
};
res.writeHead(200, headers);
res.end(`<html>
<head>
</head>
<body>
<aside class="side-menu" id="side-menu-left"></aside>
<div id="viewer-container"></div>
<div id="loading-overlay" class="loading-overlay hidden">
<h1 id="loading-progress" class="loading-progress"></h1>
</div>
<script type="module" src="https://ifcjs.github.io/web-ifc-viewer/example/build/main.js"></script>
</body>
</html>`);
};
const server = http.createServer(requestListener);
server.listen(port, host, () => {
console.log(`Server is running on http://${host}:${port}`);
});
Clicking on the first "button" on the left
and selecting an IFC file results in
Thanks!!!
I will try to find a solution
Hi is this still open?
Hi @anirudh12032008
We are going to officially release the new library components on September 20. This library will substitute web-ifc-three and web-ifc-viewer. Both WIV and WIT will remain up, but they will be deprecated and won't be maintained any longer.
All our efforts are going towards components now. The API is very similar, so I strongly suggest you make the leap and start using it. You can start using it now (check out the latest alpha version in npm or see the big-restructure branch in the repo. If you still face this issue with it, you can open an issue there and we'll take a look.
Cheers!
As a stopgap, the library could offer an option to disable applying styles, leaving the onus to the developer.
We are building a BIM viewer on a fairly large Enterprise setting.
As a big company we have to ensure security and we are subject penetration tests. This means that we have a fairly closed-up Content Security Policy configuration.
When we tried to deploy our first prototype of the viewer, we found that we needed to enable 'unsafe-eval' on CSP.
Since we know that the use of eval features it's largely a bad practice, is it possible get rid of that? Would be really important as it open the door for the execution of malicious code. ;)