Phaser: Use of Arcade Physics violates CSP [$30]

[Colbydude]

This issue arose in both v3.1.2 and v3.2.1.

Use of Arcade Physics is causing the following in the case of a Phaser game trying to be ran inside a Twitch Extension:

The code it's referring to can be found here in src/structs/RTree.js:

    _initFormat: function (format)
    {
        // data format (minX, minY, maxX, maxY accessors)

        // uses eval-type function compilation instead of just accepting a toBBox function
        // because the algorithms are very sensitive to sorting functions performance,
        // so they should be dead simple and without inner calls

        var compareArr = ['return a', ' - b', ';'];

        this.compareMinX = new Function('a', 'b', compareArr.join(format[0])); // here
        this.compareMinY = new Function('a', 'b', compareArr.join(format[1]));

        this.toBBox = new Function('a',
            'return {minX: a' + format[0] +
            ', minY: a' + format[1] +
            ', maxX: a' + format[2] +
            ', maxY: a' + format[3] + '};');
    }

This is somewhat a duplicate of #1494, but it has been many years since then.

Currently the Twitch Extension is just serving the basic Phaser 3 "Getting Started" example. We've had success switching to Impact Physics, but it's not ideal for the incredibly simple physics interactions we're trying to accomplish.

More info on Twitch's specific CSP can be found here.

Lemme know if I can provide any additional details!

---

Did you help close this issue? Go claim the $30 bounty on Bountysource.

[photonstorm]

To be honest it looks like such a trivial function we could safely replace it with a proper one. If you fancy doing a PR that’d be great. It means we diverge from the rbush source but it’s worth the trade off.

[Colbydude]

Sure, I can take a crack at it when I get some time. Might be a little over my head, but I think get the gist of what the method is trying to accomplish.

[photonstorm]

Thank you for submitting this issue. We have fixed this and the fix has been pushed to the master branch. It will be part of the next release. If you get time to build and test it for yourself we would appreciate that.

[Colbydude]

Built and tested. Working completely! Cheers. :)