Skip to content

use of eval() in dimension-handler.js requires undesirable CSP script-src 'unsafe-eval' #74

Closed
@jptrainor

Description

@jptrainor

The dimension-handler.js code uses eval(). Is there anyway other it can be implemented? It prevents use of script-src 'unsafe-eval' as part of a Content-Security-Policy.

I found this in a polymer application that is deployed in an iOS WKWebView. The paper-drop-down menu animates something using this polyfill and it breaks badly due to the eval() failing as a result of an 'unsafe-eval' policy setting. It's a shame to have to remove 'unsafe-eval' just for sake of animation. I'd be okay with a slower animation if that's the trade off.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions