Hello @matthiaspabst
In the current plugin version, it is required to evaluate the equations at runtime. However, the plugin escapes the fields’ values before using them in the equations. Note that you enter the equations by referring to the fields directly by their names, but the plugin must replace them and evaluate the equations. We are working on a mechanism to not depend on eval, but the plugin currently uses it safely.
Best regards.
Hello @matthiaspabst
Please contact us through the plugin website. We will provide you with the code currently in progress to replace the “eval.”
https://cff.dwbooster.com/contact-us
Best regards.
Hello @codepeople2
Thank you for your quick reply! Even if the eval() function is used safely in this case (is that even possible?), it does not solve the problem with a strict CSP without script-src 'unsafe-eval'. I am glad to hear that you are taking this issue seriously and working on a solution. Is it already clear when an updated version will be available?
Best regards
Matthias
@codepeople2 Sorry, just noticed your 2nd reply. I will contact you.
Hello @matthiaspabst
I wanted to follow up and see if you received the emails we sent from the plugin website. If you have, please let me know. Thank you!
@codepeople2
I received your emails, tested the script and it works! The form is not breaking now when using a CSP that doesn’t allow script-src 'unsafe-eval'.
Thank you for your quick support!
Hello @matthiaspabst
Thank you so much for the feedback.
Best regards.
Hello @matthiaspabst
We released a plugin update that includes the modifications to the file we previously provided and additional enhancements.
Best regards.
Hi @codepeople2
I installed this update and now the CSP errors because of the missing script-src 'unsafe-eval' are back. all.js line 10167 still uses eval().
I rolled back to the fbuilder.fcalculated.js you sent me a few days ago.
Best regards
Matthias
Hello @matthiaspabst
It includes the evaluation in a try/catch block. If you have enabled the protection directives, it will use the exact code we provided you from the plugin website.
try {
r = eval(eq);
} catch (err) {
if ( err instanceof EvalError ) r = $.fbuilder['eval'].call(this, eq);
else throw err;
}
Could you please provide the link to the page containing the form after you install the plugin’s update?
Best regards.
