Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using 'unset-eval' in Content Security Policy throws the error #52

Open
oleh-starodubets opened this issue Aug 31, 2022 · 0 comments
Open
Assignees

Comments

@oleh-starodubets
Copy link

Hi,
I'm using the 2key-ratchet library for end-to-end encryption in my React.js app.
After installing CSP on the website, I started facing issues with data encryption.
When trying to encrypt data, I'm getting an error asking me to add the "unsafe-eval" property to the CSP.
The application's security policy does not allow me to add the "unsafe-eval" property to the CSP.
Could you please fix this on your side or let me know how I can fix it on my side?

import * as DKeyRatchetSource from '2key-ratchet';

const DKeyRatchet = overwrite(DKeyRatchetSource);

// overwrite the package 
function overwrite(dependency) {
  const HASH_NAME = "SHA-256";
  const HMAC_NAME = "HMAC";

  dependency.Secret.importHMAC = function (raw) {
    return dependency.getEngine().crypto.subtle
      .importKey("raw", raw, { name: HMAC_NAME, hash: { name: HASH_NAME } }, true, ["sign", "verify"]);
  };

  return dependency;
}

// convert the encrypted message to a buffer and create a protocol instance from it
export async function processMessage(message) {
  const messageRaw = convertBase64ToBuffer(message);

  let messageEncrypted = await DKeyRatchet.MessageSignedProtocol.importProto(messageRaw).catch(() => { });

  if (!messageEncrypted) {
    messageEncrypted = await DKeyRatchet.PreKeyMessageProtocol.importProto(messageRaw); // Error in this method
  }

  return messageEncrypted;
}


Screenshot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants