search

UziTech / atom-jasmine2-test-runner

A test runner for Atom
https://www.npmjs.com/package/atom-jasmine2-test-runner
MIT License
3 stars 2 forks source link

Violates CSP in Atom #14

Closed lgeiger closed 7 years ago

lgeiger commented 7 years ago

Hi @UziTech,

We recently switched to atom-jasmine2-test-runner in Hydrogen and it was working great. Since today our tests started failing for no reason: https://github.com/nteract/hydrogen/issues/747.

All our tests throw EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'"..

This doesn't happen with the default Atom test runner. Do you have an idea what could cause this issue? Maybe a updated dependency broke atom-jasmine2-test-runner?

UziTech commented 7 years ago

I can reproduce this in Atom 1.16

it seems to be an issue with jasmine 2.6.0

UziTech commented 7 years ago

I released v0.6.2 which should fix this for now by setting the jasmine dependency to "2.5.3"

lgeiger commented 7 years ago

Awesome thank you for the fast fix!

You might want to look into loophole for working around Atoms CSP.

UziTech commented 7 years ago

Thanks I'll look into it.

I'll leave this issue open until we get a real fix.

UziTech commented 7 years ago

looks like loophole won't work because it doesn't allow the eval'd source to access local variables which jasmine needs. So the only way to fix this would be to get rid of the call to eval in jasmine.

I have created a pull request for this and will update the dependency once jasmine merges and releases it.

jasmine/jasmine#1330

UziTech commented 7 years ago

I just released v0.7.0 which should work with Jasmine 2.6