Content security policy would disallow Lo-Dash about lodash HOT 14 CLOSED

You can use the mobile build of Lo-Dash (lodash mobile). Its methods are inlined directly, rather than compiled at runtime.

from lodash.

Awesome! It works. :)

from lodash.

It would be nice to add a csp build option, which is more intuitive to use.

from lodash.

Related to issue: misoproject/dataset/issues/158.

from lodash.

@floydsoft I've added a csp build, alias of mobile, here. It will be documented in the next version bump (0.5.0), this week.

from lodash.

@jdalton Nice!

from lodash.

@jdalton are you sure sure that the changes actually resolve the issue? getting an issue still in my popup.

http://share.talkingtontech.com/2012-08-17_0814.png

from lodash.

The csp/mobile build inlines the templates used to create various methods but does not prevent you from using _.template in your own script which would continue to cause the error. See this comment here:

Note: For Chrome extensions use the lodash csp build and see
http://code.google.com/chrome/extensions/trunk/sandboxingEval.html

for a workaround and lemme know if that solves your issue.

from lodash.

what a pain, seems to make things 10x more complicated than they need to be!

from lodash.

what a pain, seems to make things 10x more complicated than they need to be!

Yap, it's a lame hoop to jump through, but something you would have to do using Underscore or any other lib that uses Function to generate their templates. BTW using the sandbox the normal Lo-Dash build should work ;D

from lodash.

@jdalton thanks for the input. I don't really care for all this CSP junk but guess I'll have to find a way to live with it!

from lodash.

I'm still seeing this problem in a mobile build and I think I've narrowed it down to the isJSC variable around line 175 of lodash.js.

I'm experimenting with some solutions and have come up with this:

/** Detect various environments */
var isIeOpera = !!context.attachEvent,
    isV8 = nativeBind && !/\n|true/.test(nativeBind + isIeOpera);

// On it's own line so it can be removed.
var isJSC = !/\n{2,}/.test(Function());

Also, in removeKeysOptimization adding a removeVar since isJSC is only referenced in the assignment to isKeysFast.

source = removeVar(source, "isJSC");

I'm working on a PR now, just making sure my npm test works.

from lodash.

Oh whew, that's only an issue on the edge version :D

from lodash.

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

from lodash.