1. Feedback
  2. Angular
  3. 12553

Welcome to the Angular feedback portal. We’re happy you’re here! If you have feedback on how to improve the Angular, we’d love to hear it!

  • Check out the features or bugs others have reported and vote on your favorites. Feedback will be prioritized based on popularity.
  • If you have feedback that’s not listed yet, submit your own.

Thanks for joining our community and helping improve Syncfusion products!

1
Vote

Production build with Grid has code that violates CSP

Was also created on github, but creating here as well to get some traction (

https://github.com/syncfusion/ej2-angular-ui-components/issues/91)

When using the Grid toolbar, a production build leads to a CSP error because "new Function" is used.

Things to note:

  • must be a production build
  • meta tag http-equiv="Content-Security-Policy"
  • toolbar with pdf & excel export

the following code is where the issue comes from:
return new Function("data",var str="${evalExpResult}"; return str;).bind(helper)
When run with a debugger, the evalExpResult value is :
<div class='e-input-group e-search' role='search'><input id='test_searchbar' class='e-input' name='input' type='search'placeholder= 'Search'/><span id='test_searchbutton' class='e-input-group-icon e-search-icon e-icons'tabindex='-1' title='Search' aria-label= 'search'></span></div>