{"action":"closed","issue":{"url":"https://api.github.com/repos/mozilla/pdf.js/issues/4660","labels_url":"https://api.github.com/repos/mozilla/pdf.js/issues/4660/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/pdf.js/issues/4660/comments","events_url":"https://api.github.com/repos/mozilla/pdf.js/issues/4660/events","html_url":"https://github.com/mozilla/pdf.js/issues/4660","id":31953319,"number":4660,"title":"Font renderer logic violates the Content security policy (no unsafe-eval)","user":{"login":"Rob--W","id":1365071,"avatar_url":"https://avatars.githubusercontent.com/u/1365071?v=3","gravatar_id":"","url":"https://api.github.com/users/Rob--W","html_url":"https://github.com/Rob--W","followers_url":"https://api.github.com/users/Rob--W/followers","following_url":"https://api.github.com/users/Rob--W/following{/other_user}","gists_url":"https://api.github.com/users/Rob--W/gists{/gist_id}","starred_url":"https://api.github.com/users/Rob--W/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rob--W/subscriptions","organizations_url":"https://api.github.com/users/Rob--W/orgs","repos_url":"https://api.github.com/users/Rob--W/repos","events_url":"https://api.github.com/users/Rob--W/events{/privacy}","received_events_url":"https://api.github.com/users/Rob--W/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/pdf.js/labels/1-core","name":"1-core","color":"DDDDDD"},{"url":"https://api.github.com/repos/mozilla/pdf.js/labels/4-chrome-specific","name":"4-chrome-specific","color":"e102d8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2014-04-22T08:14:31Z","updated_at":"2015-08-18T23:50:11Z","closed_at":"2015-08-18T23:50:11Z","body":"The font renderer uses a form of `eval` for rendering fonts:\r\n`display/font_loader.js`:        `this.compiledGlyphs[character] = new Function('c', 'size', js);`\r\n\r\nThis does not play well with the Chrome extension. One way to solve the problem is to add `unsafe-eval` to the CSP of the Chromium extension.\r\nAnother way is to get rid of eval. It seems that the code string follows a strict format;\r\n\r\n```\r\ncore/font_renderer.js:      js.push('c.moveTo(' + x + ',' + y + ');');\r\ncore/font_renderer.js:      js.push('c.lineTo(' + x + ',' + y + ');');\r\ncore/font_renderer.js:      js.push('c.quadraticCurveTo(' + xa + ',' + ya + ',' +\r\ncore/font_renderer.js:          js.push('c.save();');\r\ncore/font_renderer.js:          js.push('c.transform(' + scaleX + ',' + scale01 + ',' +\r\ncore/font_renderer.js:          js.push('c.restore();');\r\ncore/font_renderer.js:      js.push('c.moveTo(' + x + ',' + y + ');');\r\ncore/font_renderer.js:      js.push('c.lineTo(' + x + ',' + y + ');');\r\ncore/font_renderer.js:      js.push('c.bezierCurveTo(' + x1 + ',' + y1 + ',' + x2 + ',' + y2 + ',' +\r\ncore/font_renderer.js:              js.push('c.save();');\r\ncore/font_renderer.js:              js.push('c.translate('+ x + ',' + y + ');');\r\ncore/font_renderer.js:              js.push('c.restore();');\r\ncore/font_renderer.js:      js.push('c.save();');\r\ncore/font_renderer.js:      js.push('c.transform(' + this.fontMatrix.join(',') + ');');\r\ncore/font_renderer.js:      js.push('c.scale(size, -size);');\r\ncore/font_renderer.js:      js.push('c.restore();');\r\n```\r\n\r\nInstead of generating a string of code, we could create a list of commands.\r\nThis could be implemented as a array of commands, names and arguments (at generation in the worker) and a loop (in the viewer).\r\n\r\n@yurydelendik Do you see any issues with the proposed solution?\r\n\r\n(Here is a PDF to test, http://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf#page=11)\r\n\r\n> Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"script-src 'self' chrome-extension-resource:\"."}}