Closed wliew99 closed 1 month ago
Thanks for raising this issue.
EventCatalog v2 is coming out very soon, so going to close this as I believe it’s no longer an issue in the new version.
If you still experience this issue please raise a new issue.
Thank you!
Have you read the Contributing Guidelines on issues?
Description
Cannot render the generated events without granting unsafe-eval to the content security policy, which is very concerning as it opens up room for cross site scripting attack.
Steps to reproduce
content security policy on CloudFront distribution to serve s3 static files build from event catalog have default-src https: wss: 'self'; style-src https: 'unsafe-inline'
If i changed content security policy to default-src https: wss: 'unsafe-eval'; style-src https: 'unsafe-inline' then everything is fine.
When drilling down to our generated event details page (from plugin generation from EB), getting this on client side![image](https://github.com/boyney123/eventcatalog/assets/90648179/e1e0ef89-1b72-435b-baa1-d4939c811016)
F12 console gave this
![image](https://github.com/boyney123/eventcatalog/assets/90648179/c8b3ef52-dc59-4c72-9d8e-1322521f2adb)
Expected behavior
the generated event page to be rendered with default-src https: wss: 'self'; style-src https: 'unsafe-inline'
Actual behavior
got client side exception as it's looking for unsafe-eval to be part of CSP
Your environment