Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use of reduce-css-calc requires unsafe-eval CSP #276

Closed
jaredly opened this issue Jun 6, 2016 · 1 comment · Fixed by FormidableLabs/victory-core#91
Closed

Use of reduce-css-calc requires unsafe-eval CSP #276

jaredly opened this issue Jun 6, 2016 · 1 comment · Fixed by FormidableLabs/victory-core#91
Assignees

Comments

@jaredly
Copy link

jaredly commented Jun 6, 2016

I'd like to use victory in a chrome extension, where the default Content Security Policy disallows the use of eval (which is at the core of reduce-css-calc's functionality). Now, I can relax this manually, but eval is a notorious XSS concern, and it's much safer to disallow it.
Unfortunately, calc() literals are not allowed as svg properties (e.g. dx, dy); they are only allowed in CSS. And so without eval, lots of html syntax errors are raised, and e.g. the tick labels don't get placed correctly

Is there a way that you could remove the need for reduce-css-calc?

@tomduncalf
Copy link

+1, we've had to relax our CSP due to this :( Wonder if it could at least be made optional (and I guess accept a performance hit? or is the use more fundamental than that?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants