Cannot be used in Chrome/Firefox extensions because bundle contains eval()

[felixfbecker]

When trying to use this library in a browser extension (Chrome or Firefox) the extension will throw with

Error: Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob:".

Chrome and Firefox do not allow eval( in extensions because it is a security risk.

This seems to be related to some Google library bundled (I assume for Proto support?), search https://github.com/lightstep/lightstep-tracer-javascript/blob/master/dist/lightstep-tracer.js for eval(.

[felixfbecker]

Related: protocolbuffers/protobuf#5464

Ideally though I should be able to use this library through plain HTTP.

[iredelmeier]

Interesting, and thanks for hunting down the upstream problem! I'll investigating some other options for compilation, e.g., protobuf.js.

When you say "plain HTTP", do you mean json over HTTP?

[felixfbecker]

What I mean is that as a consumer of Lightstep, I don't really care how the data is transported. I just care that it works (including in extensions and webworkers) and doesn't bloat my bundle. Maybe there is one, but I don't understand the need for neither Thrift nor Protobuf libraries, and would at least like to avoid having both in my bundle, especially if they cause issues like this.

[iredelmeier]

Thanks for the explanation! I completely agree, and we're moving in the direction of no longer requiring code for unused transports.

[JulesPatry]

This is a rather old issue, but today I'm facing the same issue because our CSP does not allow the use of eval.

The protobuf library (a dependency on lightstep-tracer-javascript), does not package their code with commonjs_strict which then polutes the build with javascript code using eval. protocolbuffers/protobuf-javascript#25

Could lightstep-tracer-javascript work without this protobuff library?

[JulesPatry]

For anyone also experiencing a problem with using eval try using this branch in your package json
https://github.com/lightstep/lightstep-tracer-javascript/tree/v0.30.2-no-protobuf

Simply add "lightstep-tracer": "v0.30.2-no-protobuf", in your package.json and eval errors will not show up