Ember-inspector: Firefox add-on needs 'unsafe-eval' in CSP header

[Bernhard---H]

The Firefox version is not able to detect Ember application if the server sends the Content Security Policy header without 'unsafe-eval' in the script-src directive.

In the Console I get this Security-Error:

09:25:50.243 Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://zeit").  content-script.js:58:0

the path of content-script.js seems to be:

view-source:resource://gre/modules/commonjs/toolkit/loader.js -> resource://gre/modules/commonjs/sdk/loader/sandbox.js -> resource://ember-inspector-at-emberjs-dot-com/ember-inspector/data/content-script.js

and the CSP report Firefox sends to my server:

{
  "csp-report": {
    "blocked-uri": "self",
    "document-uri": "https://zeit/",
    "line-number": 58,
    "original-policy": "default-src 'none'; script-src https://zeit; style-src https://zeit; img-src https://zeit; connect-src https://zeit; form-action https://zeit; font-src https://zeit; base-uri https://zeit; report-uri https://zeit/api/csp_report",
    "referrer": "",
    "script-sample": "call to eval() or related function blocked by CSP",
    "source-file": "resource://gre/modules/commonjs/toolkit/loader.js%20-%3E%20resource://gre/modules/commonjs/sdk/loader/sandbox.js%20-%3E%20resource://ember-inspector-at-emberjs-dot-com/ember-inspector/data/content-script.js",
    "violated-directive": "script-src https://zeit"
  }
}

I also get a Logging-Error (that’s probably caused by the first error):

09:25:50.246 ember-inspector:Object {  }  sandbox.js:334

view-source:resource://gre/modules/commonjs/sdk/content/sandbox.js

[mrloop]

Think I'm seeing the same security-error if Firefox, no issue in Chrome.

13:30:31.326 Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://staging.questionr.com https://d37gvrvc0wt4s1.cloudfront.net/js/v1.7/rollbar.min.js https://js.stripe.com https://api.stripe.com https://d2716yk6zxufzb.cloudfront.net https://d1pqrzm9jil6pg.cloudfront.net").1 content-script.js:58:0

[sandstrom]

@teddyzeenny I've asked on IRC (#extdev) about this issue. I was told that if running eval using Xray Vision there shouldn't be any CSP-warning. I don't know much about Firefox addons, so it's hard for me to confirm.

Do you know if you are using Xray Vision?

https://developer.mozilla.org/en-US/docs/Xray_vision

[sandstrom]

This may be solved when moving to the WebExtension API: https://github.com/emberjs/ember-inspector/issues/666

[rwwagner90]

I believe this is no longer an issue, since some of the changes we have merged in. If anyone is still experiencing this, please feel free to reopen!

[sandstrom]

@rwwagner90 Awesome! 🎖