From 5c3f994c80e1a855c8d47bbe7e9e486e120a611f Mon Sep 17 00:00:00 2001 From: Robin Ward Date: Fri, 24 Jan 2020 13:18:03 -0500 Subject: [PATCH] DEV: For now, re-enable unsafe-eval in development mode This allows us to use `sourceURL` which otherwise does not work. In the future we hope to have proper source maps in development mode and disable this again. --- lib/content_security_policy/default.rb | 1 + lib/source_url.rb | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/content_security_policy/default.rb b/lib/content_security_policy/default.rb index 7a6f1d24a5f..2526fc3c8d3 100644 --- a/lib/content_security_policy/default.rb +++ b/lib/content_security_policy/default.rb @@ -51,6 +51,7 @@ class ContentSecurityPolicy "#{base_url}/mini-profiler-resources/", *script_assets ].tap do |sources| + sources << :unsafe_eval if Rails.env.development? # TODO remove this once we have proper source maps in dev sources << 'https://www.google-analytics.com/analytics.js' if SiteSetting.ga_universal_tracking_code.present? sources << 'https://www.googletagmanager.com/gtm.js' if SiteSetting.gtm_container_id.present? end diff --git a/lib/source_url.rb b/lib/source_url.rb index d7aa2bbb2ed..38078255f71 100644 --- a/lib/source_url.rb +++ b/lib/source_url.rb @@ -16,6 +16,9 @@ class SourceURL < Tilt::Template end def evaluate(scope, locals, &block) - "#{data.rstrip} //# sourceURL=#{scope.logical_path}\n\n" + code = +"eval(" + code << data.inspect + code << " + \"\\n//# sourceURL=#{scope.logical_path}\"" + code << ");\n" end end