search

documentcloud / visualsearch

A Rich Search Box for Real Data
http://documentcloud.github.io/visualsearch/
MIT License
1.8k stars 225 forks source link

Find a way to not use underscope templates in order to comply with CSP #117

Closed tilgovi closed 10 years ago

tilgovi commented 11 years ago

When bundling visualsearch into my Chrome extension I was pretty confused about the errors I was getting. Eventually, I tracked it to the use of _.template which uses eval(). The default content security policy I had enabled forbids this.

I've explicitly whitelisted eval for the scripts I include, but it would be great if we could find a way to avoid this. These templates aren't so complicated that it wouldn't be really simple to do the facet loop imperatively. The other two "templates" don't even appear to have replacements and could simply be strings rather than templates.

samuelclay commented 10 years ago

Problem is that for version 0.5.0 they all use template variables. I'd be open to a pull request if somebody wants to take the time to rewrite the templates so that they no longer rely on Underscore's _.template.