Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CSP Violation: Use Named Function Instead of eval in Dispatch Method #14

Merged
merged 3 commits into from
Feb 12, 2024

Conversation

jsip
Copy link
Contributor

@jsip jsip commented Dec 6, 2023

Throws a CSP violation for codebases with content security policies that do not allow unsafe-inline policies. The CSP violation occurs due to the use of setTimeout with an expression that could be interpreted as inline JavaScript, which is restricted by the CSP directive.

This fixes the violation by modifying the dispatch method to use a named function as a callback inside setTimeout instead of evaluating.

  • Refactored the dispatch method to create a named function (dispatchDebouncedEvent) as a callback for setTimeout.
  • Moved the event.target.dispatchEvent(debouncedEvent) code into the named function.
  • Updated the setTimeout call to use the named function as the callback.

@jsip
Copy link
Contributor Author

jsip commented Jan 8, 2024

@hopsoft Thank you for this library! Any chance this could see a merge in the future? Thanks

@hopsoft hopsoft merged commit b003ab0 into hopsoft:main Feb 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants