Chrome extension refused to evaluate a string as JavaScript because 'unsafe-eval' in emscripten generated file

user_276193 0
Viewed 1171

I'm trying to load up a wasm module in my Chrome plugin. Chrome complains about the following function in the wasm module generated by emscripten. It trips on the following js

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: filesystem:".

function createNamedFunction(name, body) {
      name = makeLegalFunctionName(name);
      /*jshint evil:true*/
      return new Function(
          "body",
          "return function " + name + "() {\n" +
          "    \"use strict\";" +
          "    return body.apply(this, arguments);\n" +
          "};\n"
      )(body);
    }

I'm loading the script in the background.html file so it can behave as a module . .

<script type="module" src="../js/background.js"></script>
<script type="module" src="../js/AudioWorkletProcessor.js"></script>
<script type="module" src="../js/kernel.wasmmodule.js"></script>

How are people getting around this with web assembly in their plugins?

emscripten webassembly web google-chrome-extension javascript
1 Answers

-s NO_DYNAMIC_EXECUTION=1 removes eval() and new Function() from generated code.

https://github.com/emscripten-core/emscripten/blob/master/src/settings.js#L1030

When set to 0, we do not emit eval() and new Function(), which disables some functionality (causing runtime errors if attempted to be used), but allows the emitted code to be acceptable in places that disallow dynamic code execution (chrome packaged app, privileged firefox app, etc.). Pass this flag when developing an Emscripten application that is targeting a privileged or a certified execution environment, see Firefox Content Security Policy (CSP) webpage for details: https://developer.mozilla.org/en-US/Apps/Build/Building_apps_for_Firefox_OS/CSP When this flag is set, the following features (linker flags) are unavailable: --closure 1: When using closure compiler, eval() would be needed to locate the Module object. -s RELOCATABLE=1: the function Runtime.loadDynamicLibrary would need to eval(). --bind: Embind would need to eval(). Additionally, the following Emscripten runtime functions are unavailable when DYNAMIC_EXECUTION=0 is set, and an attempt to call them will throw an exception:

  • emscripten_run_script(),
  • emscripten_run_script_int(),
  • emscripten_run_script_string(),
  • dlopen(),
  • the functions ccall() and cwrap() are still available, but they are restricted to only being able to call functions that have been exported in the Module object in advance.

When set to -s DYNAMIC_EXECUTION=2 flag is set, attempts to call to eval() are demoted to warnings instead of throwing an exception.

user_15140100
Related