global object in strict mode

Kris Kowal kris.kowal at cixar.com
Fri Aug 24 10:46:51 PDT 2012


On Fri, Aug 24, 2012 at 10:41 AM, Brendan Eich <brendan at mozilla.org> wrote:
> I'm not sure what the problem is -- I read the old thread, and noticed the
> solution:
> var global = Function("return this")();
> This is good for any code mode, strict or non-strict. Does CSP ban Function
> as well as eval?

CSP does forbid the Function constructor, by the edict “Code will not
be created from strings”.

http://www.w3.org/TR/CSP/ Section 4.2 “If unsafe-eval is not allowed…”

Kris Kowal


More information about the es-discuss mailing list