Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JS: Comply with CSP no-unsafe-eval. #8864

Merged
merged 1 commit into from Oct 14, 2021
Merged

JS: Comply with CSP no-unsafe-eval. #8864

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 10 additions & 1 deletion src/google/protobuf/compiler/js/js_generator.cc
View file
Open in desktop
Expand Up @@ -3637,7 +3637,16 @@ void Generator::GenerateFile(const GeneratorOptions& options,
if (options.import_style == GeneratorOptions::kImportCommonJsStrict) {
printer->Print("var proto = {};\n\n");
} else {
printer->Print("var global = Function('return this')();\n\n");
// To get the global object we call a function with .call(null), this will set "this" inside the
// function to the global object.
// This does not work if we are running in strict mode ("use strict"),
// so we fallback to the following things (in order from first to last):
// - window: defined in browsers
// - global: defined in most server side environments like NodeJS
// - self: defined inside Web Workers (WorkerGlobalScope)
// - Function('return this')(): this will work on most platforms, but it may be blocked by things like CSP.
// Function('') is almost the same as eval('')
printer->Print("var global = (function() { return this || window || global || self || Function('return this')(); }).call(null);\n\n");
}

for (int i = 0; i < file->dependency_count(); i++) {
Expand Down