CSP unsafe-eval required after release 5.2.2

[loremaps]

Bug Report or Feature Request (mark with an x)

- [ ] Regression (a behavior that used to work and stopped working in a new release)
- [x] Bug report -> please search issues before submitting
- [ ] Feature request
- [ ] Documentation issue or request

From release 5.2.2 our Content Security Policy gets violated because unsafe-eval are not allowed.
I think it might be related to this bump: d146258

[ColinT]

You may have to submit an issue to mozilla/pdf.js instead of here to make progress since this is a problem inside a dependency.

Here is the offending code:

// pdf.js:13152-13154
var g = function () {
  return this;
}() || Function("return this")();

In particular the Function constructor is probably triggering the unsafe-eval error. Although, I'm not sure why the regular function assignment before the || is not working for you. The eval should only be run if the first assignment fails (evaluates as a non-truthy value).

Try running the first half of the assignment in your inspector to see if it is an environment issue. Or try something like:

var g = function () {
  return 'apples';
}() || Function("return 'bananas'")();

and see what g returns.

[loremaps]

Looks like it is going to be resolved with the next release:
mozilla/pdf.js#10387
mozilla/pdf.js#10229

[loremaps]

Works with release 5.3.2

[maxime1992]

@loremaps 5.3.2 was working fine but trying to upgrade to 5.3.4 broke it again.
It's been a really painful experience to figure that out as it was happening within a lazy loaded module and the only error I had was Runtime compiler is not loaded 😱.

Any idea why it's happening again?

[loremaps]

@maxime1992 yes I believe you are also facing this issue: mozilla/pdf.js#11036
Which appears to be an upstream issue of a babel polyfill 😒

[maxime1992]

Yup thanks I commented there!

[jkroepke]

@loremaps its possible that you remove the dependency and re-add pdfjs-dist as peerDependency?
We can just downgrade the pdfjs dependencies as we need to get a rescue from this issue.

[adamdport]

Did anyone here ever resolve this issue? I'm still having issues with the latest 7.0.1.

Edit: it looks like the issue is being tracked here. Meanwhile, you can get past CSP issues by the solution in this comment. In case the link becomes stale for whatever reason, run the below before angular loads:

globalThis.regeneratorRuntime = undefined;

I have a beforeAngular.js that I load with a script tag from index.html in head.