Use case of `eval` - Githubissues

w3c / webextensions

Charter and administrivia for the WebExtensions Community Group (WECG)

Other

593 stars 54 forks source link

Use case of `eval` #69

Open Jack-Works opened 3 years ago

Jack-Works commented 3 years ago

Chrome bans eval totally in MV3

Use cases

Use Secure ECMAScript to prevent supply chain attacks
- Before the ShadowRealm lands, eval is required.
Load WebAssembly modules
- https://github.com/WebAssembly/content-security-policy/issues/7

dotproto commented 3 years ago

MetaMask's browser extension uses SES. See MetaMask/metamask-extension#9468 for links to relevant PRs.

Jack-Works commented 3 years ago

I have updated use cases

dotproto commented 6 months ago

eval() is still supported in sandboxed pages. These pages have extremely limited access to extension APIs which minimizes the risk posed by eval. It's possible to use WebAssembly through the wasm-unsafe-eval CSP directive. For details see this comment on issue 98.