Does it work with CSP unsafe-eval?

[silverwind]

Does this module would work with unsafe-eval?

If it does, this info should be added as a feature in the README, because it would be a major benefit compared to similar modules which require unsafe-eval, like these ones:

• ajv: Use with CSP & Unsafe-Eval ajv-validator/ajv#406
• schemasafe: Does not work with proper CSP settings ExodusMovement/schemasafe#153

[jdesrosiers]

I haven't actually tried it myself, but there's no reason this package shouldn't work with unsafe-eval. There's no code that evaluates strings as JavaScript anywhere in this package.

[silverwind]

Right, that sounds promising. If there are none of the 5 constructs mentioned on MDN in the codebase, you can be sure it will work.

[jdesrosiers]

I can confirm that none of those 5 constructs are used.

[silverwind]

Good enough for me, thanks 👍.