问题
I am working on a NodeJS Project and I'm using CSP
(Content Security Policy).
I'm using a external plugin FullCalendar
which is being blocked by csp giving the following error:
Error: call to Function() blocked by CSP
I use script-src 'self' 'unsafe-eval';
to override it but did not work in firefox. In other browser it is working fine.
I got stuck on this issue by 4h.
It would be helpful to get the solution.
I am using the following format in CSP restrictions.
X-Content-Security-Policy: default-src *; script-src 'self' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline img-src *;options eval-script;
X-WebKit-CSP: default-src *; script-src 'self' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline img-src *;
Content-Security-Policy: default-src *; script-src 'self' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline img-src *;
回答1:
assuming this.disp
is containing the expression to be evaluated. Also disp: document.getElementById("id_of_text_input_field")
. For eg. this.disp.value = 123/45*67+8-9%10
. It will also care for negative
nos. For eg. -123+3
= -120
. Yay!
compute: function compute() {
var sign = 1;
if (this.disp.value[0] == '-') sign = -1;
this.disp.value = this.calculate(this.disp.value,sign);
this.update(this.disp.value.length);
return this.disp.value;
},
calculate: function calculate(input,sign){
var opr_list = { add : '+'
, sub : '-'
, div : '/'
, mlt : '*'
, mod : '%'
};
opr_list.opr = [[ [opr_list.mlt] , [opr_list.div] , [opr_list.mod]],
[ [opr_list.add] , [opr_list.sub] ]];
input = input.replace(/[^0-9%^*\/()\-+.]/g,'');
var output,n;
for(var i=0, n=opr_list.opr.length; i<n; i++ ){
var re = new RegExp('(\\d+\\.?\\d*)([\\'+opr_list.opr[i].join('\\')+'])(\\d+\\.?\\d*)');
re.lastIndex = 0;
while( re.test(input) ){
output = this.compute_result(opr_list,sign*RegExp.$1,RegExp.$2,RegExp.$3);
if (isNaN(output) || !isFinite(output)) return output;
input = input.replace(re,output);
}
}
return output;
},
compute_result: function compute_result(opr_list,a,op,b){
a=a*1; b=b*1;
switch(op){
case opr_list.add: return a+b; break;
case opr_list.sub: return a-b; break;
case opr_list.div: return a/b; break;
case opr_list.mlt: return a*b; break;
case opr_list.mod: return a%b; break;
default: null;
}
}
You can add more operators and cases as per your requirements. For eg. Square, x^y
, etc.
来源:https://stackoverflow.com/questions/18080509/call-to-function-blocked-by-csp-even-after-adding-unsafe-eval