search

karak / riot-test-renderer

Lightweight testing utility for Riot
2 stars 0 forks source link

CSP #18

Open karak opened 6 years ago

karak commented 6 years ago

We must avoid raw eval() for CSP(Content Security Policy) as warned by Rollup.

Now, we could have safeEval, if it can simply alternate our eval() -- scripts in tags are user-defined -- and is available on browsers in UMD modules.

karak commented 6 years ago

Solve that warning is easy and quick. We can replace those points of execution by IIFE module.

karak commented 6 years ago

As for CSP, Riot itself implements its own safeEval on esprima with hoister. I guess they seek smaller size why not using notEvil constructed by the same stack.

karak commented 6 years ago

I'll close this issue because I suspect many Chrome Extensions uses raw browsers including Karma, or Node.js like sinon-chrome.

Testing frameworks needn't support CSP like riot itself.