Skip to content

Request to Remove or Address unsafe-eval Usage in Yoga Layout #1767

@buzzo123

Description

@buzzo123

Hi Yoga Layout Team,

I am currently using @react-pdf/renderer (version ^4.1.5) in my project, which depends on yoga-layout. During development, I've encountered issues related to the usage of unsafe-eval within yoga-layout.

Problem

The inclusion of unsafe-eval poses significant security risks and violates stricter Content Security Policies (CSPs), which are becoming increasingly common in modern web applications. This makes it challenging to use yoga-layout in secure environments without relaxing CSP rules, which isn't always an acceptable solution.

Steps to Reproduce

  1. Integrate @react-pdf/renderer (which uses yoga-layout) into a project.
  2. Implement a CSP policy that disallows unsafe-eval.
  3. Observe the resulting errors when attempting to use yoga-layout.

Let me know if additional details, examples, or assistance with refactoring would be helpful. Thank you for all the effort you’ve put into maintaining this essential library!

Best regards,
Michele

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions