search

misoproject / dataset

JavaScript library that makes managing the data behind client-side visualisations easy
http://misoproject.com
GNU General Public License v2.0
1.18k stars 99 forks source link

Chrome extension security: Code generation from strings disallowed #158

Closed g2010a closed 12 years ago

g2010a commented 12 years ago

Google will be disallowing eval and other 'dangerous' methods in extensions ( see https://code.google.com/chrome/extensions/contentSecurityPolicy.html ). This means that extensions relying on Miso are already breaking. Can Dataset be implemented in compliance with Google's requirements?

g2010a commented 12 years ago

... hm. It seems to be the dependency on lodash.js that triggers the alert. Installing the unminified package and replacing lodash with underscore works.

alexgraul commented 12 years ago

Thats...an unexpected issue. Will investigate.

jdalton commented 12 years ago

The issue you are seeing is because of lodash's use of _.template, which uses Function(...), to build methods optimized for the current environment. For Chrome extensions you can use the mobile build lodash mobile which has methods inlined, not compiled. That should avoid the issue.

For more info on builds check out http://lodash.com/#custom-builds.

g2010a commented 12 years ago

Thanks, I'll check out the lodash mobile build.

jdalton commented 12 years ago

Related to issue: lodash/issues/54.

alexgraul commented 12 years ago

I think the answer here is just to use the mobile build if you're doing an extension, I'm not sure there's much point us offering a separate build and we can't switch wholesale without breaking IE support. Another one for the wiki a la #170

jdalton commented 12 years ago

Cool, I aliased the lodash mobile build as lodash csp too.