When CSP headers are used eval is forbidden unless unsafe-eval is included. And when the code is loaded as an es module the with syntax is forbidden. This means an alternative implementation is needed for strict safe code.
We could have a subset of js that is parsed and interpreted. This could be only a limited set of expression features, like object access and basic binary expressions. It could also be limited to helperMethod(property.chain) where helper method is registered in the js code.
Another option would be to precompile all the expressions. But that requires a build step, which we don't want.
When CSP headers are used eval is forbidden unless unsafe-eval is included. And when the code is loaded as an es module the with syntax is forbidden. This means an alternative implementation is needed for strict safe code.
We could have a subset of js that is parsed and interpreted. This could be only a limited set of expression features, like object access and basic binary expressions. It could also be limited to
helperMethod(property.chain)where helper method is registered in the js code.Another option would be to precompile all the expressions. But that requires a build step, which we don't want.