-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Open
Description
Hi Yoga Layout Team,
I am currently using @react-pdf/renderer
(version ^4.1.5
) in my project, which depends on yoga-layout
. During development, I've encountered issues related to the usage of unsafe-eval
within yoga-layout
.
Problem
The inclusion of unsafe-eval
poses significant security risks and violates stricter Content Security Policies (CSPs), which are becoming increasingly common in modern web applications. This makes it challenging to use yoga-layout
in secure environments without relaxing CSP rules, which isn't always an acceptable solution.
Steps to Reproduce
- Integrate
@react-pdf/renderer
(which usesyoga-layout
) into a project. - Implement a CSP policy that disallows
unsafe-eval
. - Observe the resulting errors when attempting to use
yoga-layout
.
Let me know if additional details, examples, or assistance with refactoring would be helpful. Thank you for all the effort you’ve put into maintaining this essential library!
Best regards,
Michele
guillaumeduboc and stephtr
Metadata
Metadata
Assignees
Labels
No labels