When I using wasm version of zxing-cpp, we meet CSP 'unsafe-eval' issue, how can we fix it? #977
Replies: 6 comments 15 replies
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
Never seen that before. @Sec-ant: Do you have any idea? |
Beta Was this translation helpful? Give feedback.
-
|
@AlexXiong-dev You can use |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, wrong pic attached. |
Beta Was this translation helpful? Give feedback.
-
It looks to me that the source of this error is no longer related to Webassembly instantiation. Probably there's some js evaluating in the emitted js glue code that comes along with the Webassembly artifact when built using Emscripten. But without further information on how you have built and used the wasm file, I can hardly provide any useful assistance. |
Beta Was this translation helpful? Give feedback.
-
|
Got it, Thanks very much. I will continue to investigate it. |
Beta Was this translation helpful? Give feedback.
-
|
And we use the wasm file in 2.1.0 release directly: https://github.com/zxing-cpp/zxing-cpp/releases/download/v2.1.0/wasm-artifacts.zip |
Beta Was this translation helpful? Give feedback.
-
|
That should be what's causing the CSP issue. |
Beta Was this translation helpful? Give feedback.
-
|
GIthub Copilot suggested me to rebuild wasm with option "-s DYNAMIC_EXECUTION=0" to avoid dynamic code evaluation for this bug, I did. But then during running, I can not find zxing.HEAPU8 when decoding barcode following the sample code in /master/wrappers/wasm/demo_cam_reader.html. |
Beta Was this translation helpful? Give feedback.
-
|
And I haven't tested whether this change will fix the CSP error. |
Beta Was this translation helpful? Give feedback.
-
|
Also, if you want to use a wasm build of zxing-cpp for production env, have you tried https://github.com/Sec-ant/zxing-wasm ?
I the maintainer of that package, and it should be easier to tackle. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, I see the flag. It works. |
Beta Was this translation helpful? Give feedback.
-
That package also supports cjs or umd usage. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Sec-ant, |
Beta Was this translation helpful? Give feedback.
-
|
After building the new zxing_reader.js, I still need to do below hard code to it:
@Sec-ant , do you know any parameter to config it directly during building? |
Beta Was this translation helpful? Give feedback.
-
|
Emscripten removes the option to disable
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks very much, I will try version 4.0.3 tomorrow. |
Beta Was this translation helpful? Give feedback.
-
|
Works well with v4.0.3 |
Beta Was this translation helpful? Give feedback.
-
|
Finally, we found out that only need to add "-s DYNAMIC_EXECUTION=0" to build the wasm binary, then do some little customization locally, we can avoid this CSP issue too. (Still need Customer to use 'wasm-unsafe-eval' ) |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
We meet CSP 'unsafe-eval' issue when using zxing_reader.wasm, if we don't want to set CSP to allow unsafe-eval, how can we fix this?
Beta Was this translation helpful? Give feedback.
All reactions