Eval Function("return this") is not secure

[Yunchitz]

Attach (recommended) or Link to PDF file here:

Configuration:

• Web browser and its version:
• Operating system and its version: WIN 10
• PDFjs-dist version: 2.1.266
• Is a browser extension:

Steps to reproduce the problem:

1. Include lib to project with <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline'>

What is the expected behavior? (add screenshot)
Please replace Function("return this") with not eval approach. Thanks a lot!
What went wrong? (add screenshot)

Link to a viewer (if hosted on a site other than mozilla.github.io/pdf.js or as Firefox/Chrome extension):

[Snuffleupagus]

Please replace Function("return this") with not eval approach.

This is done for performance reasons, and will consequently not be removed; as such this issue is INVALID.

However, if you look at the API documentation you'll see that this is already user-configurable when calling getDocument:

pdf.js/src/display/api.js

Lines 178 to 180 in fef86cc

	* @property {boolean} isEvalSupported - (optional) Determines if we can eval
	* strings as JS. Primarily used to improve performance of font rendering,
	* and when parsing PDF functions. The default value is `true`.

[Yunchitz]

It is happens only in two cases:
var g = function () {
return this;
}() || Function("return this")();
AND
(function () {
return this;
}() || Function("return this")());
/* WEBPACK VAR INJECTION */}.call(this, w_pdfjs_require(140)(module)))

May be it is happens before you add check isEvalSupported with try catch

Could you please help to fine a solution? We can't change the code of lib due to this is a npm module
Thank a lot!
Can I do like this
_pdfjs = require('pdfjs-dist');
_pdfjs.workerSrc = '../node_modules/pdfjs-dist/build/pdf.worker.js';
_pdfjs.isEvalSupported = false;

[Snuffleupagus]

What's described in #10818 (comment) sounds like a duplicate of issue #10229 (which wasn't clear from the original comment above).

[timvandermeij]

Yes, I would agree on the duplicate.