Content Security Policy infringing code
This package depends on ajv which internally uses new Function(..., sourcecode), equivalent to eval(). This is documented in their readme.
The result of this is that any package bundling conf (or electron-store) infringes secure CSPs. That is, a CSP without an 'unsafe-eval' directive.
Ideally, a package shouldn't prohibit use of a strict CSP.
- Are there any workarounds I'm not aware of that can be documented?
- Does this package need to be modularised so that those with no CSP & wanting schema validation can have this functionality?
sindresorhus / conf
Simple config handling for your app or module
1.2k
How does funding with Polar work?
1
Pay now to fund the work behind this issue.
2
Get updates on progress being made.
3
Maintainer is rewarded once the issue is completed.
FAQ
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too