search

lume / classy-solid

Solid.js reactivity patterns for classes, and class components. See https://github.com/lume/element for a Custom Element system built with classy-solid.
MIT License
51 stars 2 forks source link

Classy violates Contnent Security Policy #5

Closed GodBleak closed 1 year ago

GodBleak commented 1 year ago

I'm unable to use classy while using the script-src directive in a Content Security Policy due to the use of the new Function() constructor. Is it possible to avoid using it?

trusktr commented 1 year ago

I don't see the use of new Function anywhere. Is it perhaps your build tool adding that?

trusktr commented 1 year ago

Almost ready to release classy-solid on stage 3 decorators. I've checked locally, and there are no uses of new Function.

The upcoming release will no longer support legacy decorators, only the new stage 3 decorators (https://github.com/lume/classy-solid/pull/4), to keep things simple in the implementation. Then we'll also need to update Vite docs to use the latest Babel decorator config.

Closing since it won't be relevant, and maybe even the problem goes away whatever it was (I'm guessing build tool thing?).

GodBleak commented 1 year ago

I think it's actually the dependency lowclass that's causing it, these lines particularly lowclass/Class.ts:81, lowclass/Class.ts:298, and lowclass/Class.ts:540