Use case of eval

[Jack-Works]

Chrome bans eval totally in MV3

Use cases

• Use Secure ECMAScript to prevent supply chain attacks

  • Before the ShadowRealm lands, eval is required.

• Load WebAssembly modules

  • No way to use WebAssembly on Chrome without 'unsafe-eval' WebAssembly/content-security-policy#7

[dotproto]

MetaMask's browser extension uses SES. See MetaMask/metamask-extension#9468 for links to relevant PRs.

[Jack-Works]

I have updated use cases

[dotproto]

eval() is still supported in sandboxed pages. These pages have extremely limited access to extension APIs which minimizes the risk posed by eval. It's possible to use WebAssembly through the wasm-unsafe-eval CSP directive. For details see this comment on issue 98.