Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(runtime): prefer using globalThis directly #3108

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

danhorvath
Copy link

Description

When getting a reference to the global this, the current code tries to run new Function('return this')() which is blocked by most CSPs. While the fallback code in the catch runs fine so there's no runtime error, the CSP violations still might get reported which pollutes the tracking data.

This PR changes the logic so it prefers returning globalThis directly, similarly to the webpack runtime:

__webpack_require__.g = (() => {
if (typeof globalThis === 'object') return globalThis;
try {
return this || new Function('return this')();
} catch (e) {
if (typeof window === 'object') return window;
}
})();

Related Issue

Fixes #3103

Types of changes

  • Docs change / refactoring / dependency upgrade
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Checklist

  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • I have updated the documentation.

The workaround to getting globalThis via evaluating "return this" gets blocked by commonly used CSPs
and running it can results in an increased number of CSP violations being tracked.

fix module-federation#3103
Copy link

changeset-bot bot commented Oct 23, 2024

⚠️ No Changeset found

Latest commit: ac1dc20

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copy link

netlify bot commented Oct 23, 2024

Deploy Preview for module-federation-docs ready!

Name Link
🔨 Latest commit ac1dc20
🔍 Latest deploy log https://app.netlify.com/sites/module-federation-docs/deploys/671907b2143d640008a8da24
😎 Deploy Preview https://deploy-preview-3108--module-federation-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Content Security Policy unsafe-eval violation in runtime
1 participant