Issue #3558Opened June 22, 2021by aimeos2 reactions

FEAT: Support Content-Security-Policy

Question

To reduce the possible attack surface if the editor is used in "hostile" environments (e.g. in SaaS platforms) support for CSP is required. This will also prevent problems like https://github.com/artf/grapesjs/issues/3082

At the moment, the only problem that prevents effective CSP rules is the use of new Function() in the GrapesJS code, which requires a CSP rule of unsafe-eval.

Is there a different way to implement that?

Answers (3)

artfAugust 5, 20212 reactions

ok then, I'll try to fix it for the next release.

artfJune 24, 20210 reactions

mmm I'm not sure exactly how I'm able to fix it and what do you mean by is the use of new Function() in the GrapesJS code as there is no such a thing in the source?

aimeosJune 24, 20210 reactions

Found out that it's in the dist files due to underscore.js template() method which uses new Function(). I think this will make it hard to replace or remove that dependency to enforce a CSP without 'unsafe-eval'.

Related Questions and Answers

Continue research with similar issue discussions.

Paid Plugins That Match This Issue

Curated by issue keywords and label relevance to help you ship faster.

View all plugins

Loading paid plugin recommendations...

Browse Plugin Categories

Jump directly to plugin category pages on the marketplace.