{"action":"created","issue":{"url":"https://api.github.com/repos/systemjs/systemjs/issues/531","labels_url":"https://api.github.com/repos/systemjs/systemjs/issues/531/labels{/name}","comments_url":"https://api.github.com/repos/systemjs/systemjs/issues/531/comments","events_url":"https://api.github.com/repos/systemjs/systemjs/issues/531/events","html_url":"https://github.com/systemjs/systemjs/issues/531","id":89378700,"number":531,"title":"CSP: support transpiling in eval environments","user":{"login":"OliverJAsh","id":921609,"avatar_url":"https://avatars.githubusercontent.com/u/921609?v=3","gravatar_id":"","url":"https://api.github.com/users/OliverJAsh","html_url":"https://github.com/OliverJAsh","followers_url":"https://api.github.com/users/OliverJAsh/followers","following_url":"https://api.github.com/users/OliverJAsh/following{/other_user}","gists_url":"https://api.github.com/users/OliverJAsh/gists{/gist_id}","starred_url":"https://api.github.com/users/OliverJAsh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OliverJAsh/subscriptions","organizations_url":"https://api.github.com/users/OliverJAsh/orgs","repos_url":"https://api.github.com/users/OliverJAsh/repos","events_url":"https://api.github.com/users/OliverJAsh/events{/privacy}","received_events_url":"https://api.github.com/users/OliverJAsh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-18T19:34:44Z","updated_at":"2015-06-18T20:08:15Z","closed_at":null,"body":"Chrome Extensions allow you to modify CSP to allow usage of `eval` (`script-src 'self' 'unsafe-eval'`), but not inline scripts (`unsafe-inline`). This means that, unless you're not transpiling and using the CSP version, you must bundle.\r\n\r\nCould SystemJS optionally use `eval` instead of [injecting transpiled code using an inline script tag](https://github.com/systemjs/systemjs/blob/15cb1e2f82c0ca541213fbcfe07fbe81e2ee2588/lib/global-eval.js#L38-L55)? Perhaps there is a reason we are using inline script tags over `eval`? Could `eval` be supported behind an option, for the sake of enabling a nice \"refresh to reload\" workflow when working in environments such as Chrome Extensions?"},"comment":{"url":"https://api.github.com/repos/systemjs/systemjs/issues/comments/113275378","html_url":"https://github.com/systemjs/systemjs/issues/531#issuecomment-113275378","issue_url":"https://api.github.com/repos/systemjs/systemjs/issues/531","id":113275378,"user":{"login":"guybedford","id":598730,"avatar_url":"https://avatars.githubusercontent.com/u/598730?v=3","gravatar_id":"","url":"https://api.github.com/users/guybedford","html_url":"https://github.com/guybedford","followers_url":"https://api.github.com/users/guybedford/followers","following_url":"https://api.github.com/users/guybedford/following{/other_user}","gists_url":"https://api.github.com/users/guybedford/gists{/gist_id}","starred_url":"https://api.github.com/users/guybedford/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guybedford/subscriptions","organizations_url":"https://api.github.com/users/guybedford/orgs","repos_url":"https://api.github.com/users/guybedford/repos","events_url":"https://api.github.com/users/guybedford/events{/privacy}","received_events_url":"https://api.github.com/users/guybedford/received_events","type":"User","site_admin":false},"created_at":"2015-06-18T20:08:15Z","updated_at":"2015-06-18T20:08:15Z","body":"Certainly we can support this by passing through to this conditional - https://github.com/systemjs/systemjs/blob/master/lib/global-eval.js#L60.\r\n\r\nIt's just about coming up with an adequate feature detection that will work in this scenario.\r\n\r\nThe reason we use `<script>` injection is to preserve maximum global compatibility for global assignments via `var global = 'val'`."}}