CSP 'unsafe-eval' required for Knockout.js, see issue #103

the-djmaze · Jul 28, 2021 · e0106a6 · e0106a6
1 parent a3d2b56
commit e0106a6
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Service.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
@@ -207,7 +207,9 @@ private function setCSP(string $sScriptNonce = null) : void
 			if ($sScriptNonce) {
 				$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", "\$1'nonce-{$sScriptNonce}'", $sContentSecurityPolicy);
 			}
-			$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", '', $sContentSecurityPolicy);
+			$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", '$1', $sContentSecurityPolicy);
+			// Knockout.js requires eval() for observable binding purposes
+			//$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-eval'/", '$1', $sContentSecurityPolicy);
 		}
 		\header('Content-Security-Policy: '.$sContentSecurityPolicy, true);
 	}