0

I need create RSA signature in my Chrome packaged app written with Backbone.js. But when I use jsrsasign I get:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an 
allowed source of script in the following Content Security Policy directive: 
"default-src 'self' chrome-extension-resource:". Note that 'script-src' was 
not explicitly set, so 'default-src' is used as a fallback.

I tried to set up content_security_policy, but it's not working with packaged apps. So how to workaround this?

The code which causes problems is:

var sig = new KJUR.crypto.Signature({"alg": "SHA1withRSA", "prov": "cryptojs/jsrsa"});

And the lib is calling eval:

this.md = eval(KJUR.crypto.Util.CRYPTOJSMESSAGEDIGESTNAME[alg]).create();
1
  • 1
    Switch library and/or try to file an issue with the original library? You can't relax this policy for apps.
    – Xan
    Apr 8, 2014 at 14:20

1 Answer 1

1

At first sight, it seems that you can patch that line in the library with:

this.md = CryptoJS.algo[alg.toUpperCase()].create();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.