Rollupjs build complains about the use of eval in this library. about js-sha256 HOT 7 CLOSED

Even more, this prevents us from not using 'unsafe-eval' in our Content Security Policy. Any chance that this one get fixed?

from js-sha256.

Can it be changed to a dynamic import or anything along those lines to avoid the use of eval()?

from js-sha256.

It also breaks in vitejs. We need a fix.

from js-sha256.

remove eval in v0.10.0

from js-sha256.

This is because emn178/js-md5#8
And I found it won't polyfill unused code in this way.

from js-sha256.

As a fix, you can replace the eval strings in the library during build.
In rollup.config.js:

import replace from "rollup-plugin-re";

export default {
  ...,
  plugins: [
    replace({
      patterns: [
        {
          match: /js-sha256/,
          test: `eval("require('crypto')")`,
          replace: `require('crypto')`
        },
        {
          match: /js-sha256/,
          test: `eval("require('buffer').Buffer")`,
          replace: `require('buffer').Buffer`
        }
      ],
    }),
  ]
}

from js-sha256.

An alternative to suppress warnings in vite.config.js:

export default defineConfig({
  build: {
    rollupOptions: {
      onwarn: ({ loc }) => {
        if (loc?.file?.match(/js-sha256\/src\/sha256.js$/))
            return;
      } 
  }
});

from js-sha256.