global object in strict mode
kris.kowal at cixar.com
Fri Aug 24 10:46:51 PDT 2012
On Fri, Aug 24, 2012 at 10:41 AM, Brendan Eich <brendan at mozilla.org> wrote:
> I'm not sure what the problem is -- I read the old thread, and noticed the
> var global = Function("return this")();
> This is good for any code mode, strict or non-strict. Does CSP ban Function
> as well as eval?
CSP does forbid the Function constructor, by the edict “Code will not
be created from strings”.
http://www.w3.org/TR/CSP/ Section 4.2 “If unsafe-eval is not allowed…”
More information about the es-discuss