search

sandanat / vue-pdf-app

VUEjs v2 PDF viewer based on Mozilla's PDFJS
MIT License
213 stars 97 forks source link

Why is eval used? Vulnerable to XSS attacks #113

Open JakobJFL opened 11 months ago

JakobJFL commented 11 months ago

When I use vue-pdf-app in my Vue Chrome extension, nothing can run because eval is used in the source code. I get errors like: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

And errors like: Use of eval in "node_modules/vue3-pdf-app/dist/vue3-pdf-app.umd.js" is strongly discouraged as it poses security risks and may cause issues with minification.

My question is why this is used in the source code because I don't want my application to be vulnerable to XSS attacks.

ultimaustin commented 3 months ago

I second this bug. I really like this library but I can't use it because of the issue described here.

It looks like the original issue in pdfjs has been resolved so I wonder if the code can port that fix?