Revert "ELEMENTS-1759: Remove usage of unsafe-eval from CSP"

This reverts commit 02beb92.
nuxeo · Oct 30, 2024 · 28f7067 · 28f7067
1 parent 02beb92
commit 28f7067
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 20 deletions.
diff --git a/ui/nuxeo-filter.js b/ui/nuxeo-filter.js
@@ -18,6 +18,7 @@ limitations under the License.
 import '@polymer/polymer/polymer-legacy.js';
 
 import '@nuxeo/nuxeo-elements/nuxeo-element.js';
+import { config } from '@nuxeo/nuxeo-elements';
 import { Debouncer } from '@polymer/polymer/lib/utils/debounce.js';
 import { microTask } from '@polymer/polymer/lib/utils/async.js';
 import { enqueueDebouncer } from '@polymer/polymer/lib/utils/flush.js';
@@ -184,25 +185,29 @@ import Interpreter from './js-interpreter/interpreter.js';
       let res = false;
 
       try {
-        const js = new Interpreter(expression, (interpreter, scope) => {
-          // set scope
-          interpreter.setProperty(scope, 'this', interpreter.nativeToPseudo(FiltersBehavior));
-          Object.entries({ document, user }).forEach(([k, obj]) => {
-            const v = {};
-            // filter out private properties
-            Object.getOwnPropertyNames(obj)
-              .filter((p) => !p.startsWith('_'))
-              .forEach((p) => {
-                v[p] = obj[p];
-              });
-            interpreter.setProperty(scope, k, interpreter.nativeToPseudo(v));
+        if (!config.get('expressions.eval', true)) {
+          const js = new Interpreter(expression, (interpreter, scope) => {
+            // set scope
+            interpreter.setProperty(scope, 'this', interpreter.nativeToPseudo(FiltersBehavior));
+            Object.entries({ document, user }).forEach(([k, obj]) => {
+              const v = {};
+              // filter out private properties
+              Object.getOwnPropertyNames(obj)
+                .filter((p) => !p.startsWith('_'))
+                .forEach((p) => {
+                  v[p] = obj[p];
+                });
+              interpreter.setProperty(scope, k, interpreter.nativeToPseudo(v));
+            });
+            // XXX: 'this' in the scope of native functions is the interpreter instance
+            Object.assign(interpreter, FiltersBehavior);
           });
-          // XXX: 'this' in the scope of native functions is the interpreter instance
-          Object.assign(interpreter, FiltersBehavior);
-        });
-        js.run();
-        res = js.value;
-
+          js.run();
+          res = js.value;
+        } else {
+          const fn = new Function(['document', 'user'], `return ${expression};`);
+          res = fn.apply(this, [document, user]);
+        }
         return res;
       } catch (err) {
         console.error(`${err} in <nuxeo-filter> expression "${expression}"`);

diff --git a/ui/viewers/pdfjs/web/viewer.html b/ui/viewers/pdfjs/web/viewer.html
@@ -29,11 +29,11 @@
 
 <!-- This snippet is used in production (included from viewer.html) -->
 <link rel="resource" type="application/l10n" href="locale/locale.json">
-<script src="../build/pdf.mjs" type="module"  nonce="dummy"></script>
+<script src="../build/pdf.mjs" type="module"></script>
 
     <link rel="stylesheet" href="viewer.css">
 
-  <script src="viewer.mjs" type="module"  nonce="dummy"></script>
+  <script src="viewer.mjs" type="module"></script>
   </head>
 
   <body tabindex="1">