pixiebrix-extension
pixiebrix-extension copied to clipboard
Remove 'unsafe-eval' from CSP
'unsafe-eval' is not allowed in MV3’s manifest:
Dropping it resurfaces:
- https://github.com/pixiebrix/pixiebrix-extension/issues/2946
Tasks
- [ ] Revert https://github.com/pixiebrix/pixiebrix-extension/pull/3019
Our options
- Get RJSF to add support for an eval-less validation library (either by asking nicely or by submitting as PR). We use: npmjs.com/package/@cfworker/json-schema. (I had actually looked at AJV previously but didn't use it because of eval)
- Move schema validation to the Chrome sandbox: Move template engine and brick evaluation to Chrome sandbox #105. This also would probably require modifying RJSF to support a custom validation function. This approach is nice because it also makes sense to move Nunjucks and JQ over there
- Modify AJV to not require Function