AlpineJS for Web Extensions - Use of eval() prohibited

[gdeflaux]

Hi,

I am building a web extension using AlpineJS. The use of any form of eval() function is prohibited hence I am unable to publish the extension on the Mozilla Addons directory.

On version 2.8.2, the warning appears on line 144:

return new Function(['$data', ...Object.keys(additionalHelperVariables)], `var __alpine_result; with($data) { __alpine_result = ${expression} }; return __alpine_result`)(dataContext, ...Object.values(additionalHelperVariables));

and line 165:

let methodReference = new Function(['dataContext', ...Object.keys(additionalHelperVariables)], `with(dataContext) { return ${expression} }`)(dataContext, ...Object.values(additionalHelperVariables));

Any idea if there is a workaround for this?

Thanks!

[ryangjchandler]

We use Alpine for the DevTools extension - @HugoDF might be able to help.

[gdeflaux]

@ryangjchandler Thanks for your answer. I've check your extension's manifest.json and you have the following line:

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src",

Which is identical to what I had. Maybe it's OK to have unsafe-eval for dev tools. But it's not ok for general purpose extensions. At least on the Mozilla store.

As far as I can see, I'd have to port my extension to AlpineJS v3 and use the CSP package.

[ryangjchandler]

@gdeflaux Yeah, that's going to be your best bet (CSP route).

[calebporzio]

Ah @gdeflaux, that's a bummer. Yeah, go for the CSP build, and keep in mind, we can improve that build with more intelligent parsing abilities for a nicer experience - right now, It's pretty restricting.