globalizejs / globalize

A JavaScript library for internationalization and localization that leverages the official Unicode CLDR JSON data
https://globalizejs.com
MIT License
4.8k stars 603 forks source link

CSP unsafe-eval problem for currency module #879

Closed josundt closed 4 years ago

josundt commented 4 years ago

We use date, number and currency formatting in our application suite.

I suddenly found that the currency module does not work with our current CSP policy which disallows unsafe-eval, since the currency module depends on the plural module which in turn depends on the make-plural library.

I know this has been reported earlier in case #591, but that's 3 years ago. I think the evolution of web security justifies bringing this up again. These days CSP with unsafe-eval is unacceptable for most web applications.

First of all: Would it be possible to remove the plural module dependency from the currency module, or at least make it optional? (It seems to me like the plural module only has any effect when formatting an amount with a numeric value of 1. We could live without that).

My second request: Would it not be great if Globalize supported dynamic loading of pre-compiled/localized make-plural js-modules as an alternative to loading supplemental/plurals json data from cldr? In our applications, we host cldr-data on our CDN and we have made a loader library that feeds the json data into Globalize when starting up/switching culture. We could just as well have hosted pre-compiled pre-compiled/localized make-plural modules there if Globalize supported dynamically loading them.

The current workaround I am using is to make currency formatting work is to not load the Globalize plurals module, and then monkey-patch Globalize with a simplified Globalize.pluralGenerator function in our code instead.

rxaviers commented 4 years ago

First of all: Would it be possible to remove the plural module dependency from the currency module, or at least make it optional? (It seems to me like the plural module only has any effect when formatting an amount with a numeric value of 1. We could live without that).

It has been removed in v1.5.0 for styles that don't use it such as symbol and code. The requirement still remains for style name.

rxaviers commented 4 years ago

My second request: Would it not be great if Globalize supported dynamic loading of pre-compiled/localized make-plural js-modules as an alternative to loading supplemental/plurals json data from cldr?

For that approach, we have globalize-compiler. Please let me know if there's any outstanding problem. Thanks