jiggzson / nerdamer

a symbolic math expression evaluator for javascript
http://www.nerdamer.com
MIT License
518 stars 82 forks source link

Content Security Policy (CSP) blocking due to "unsafe-eval" #650

Open richardbullin opened 2 years ago

richardbullin commented 2 years ago

When CSP is configured to help mitigate against XSS attacks, trying to take the definitive integral can cause script to be blocked.

The below example uses version 1.1.11 (1.1.12 not available?) this generates an incorrect answer (expect 1.148) image

The below example uses version 1.1.13 (dev version) which generates the correct answer but causes CSP block.

image

I tracked it down to the 'build' function within 'nerdamer.core.js' around line 11882 where "new Function(args, ....." is called.

image

I'm guessing it only gets to this part if it can't determine the result? Is there any way to re-write this without calling "new Function"? Allowing 'unsafe-eval' is not an option as this defeats the whole purpose of CSP.

Cheers