Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Usage of Function means that Content Security Policy for websites using Label Studio must include 'unsafe-eval' #7189

Open
benglewis opened this issue Mar 9, 2025 · 3 comments · May be fixed by #7190
Open

Usage of Function means that Content Security Policy for websites using Label Studio must include 'unsafe-eval' #7189

benglewis opened this issue Mar 9, 2025 · 3 comments · May be fixed by #7190
Labels
community_feature-request

Comments

@benglewis
Copy link

Currently, since Label Studio is using Function in the utils.js file for Label Studio's Data Manager's utilities, anyone that wants to use Label Studio must allow 'unsafe-eval' in their Content Security Policy (CSP) on the website which uses Label Studio:

label-studio/web/libs/datamanager/src/components/Common/Table/utils.js

Line 16 in 827e3a6

const fn = new Function("object", `return object${normalizedPath}`);

I suggest fixing this by using a different implementation.
benglewis added a commit to benglewis/label-studio that referenced this issue Mar 9, 2025
@benglewis
Fix CSP issue by removing unsafe-eval usage
2e15e3f 
Fixes HumanSignal#7189

Replace the `Function` constructor in the `getProperty` function with a safer implementation.

* Use a loop to traverse the object properties based on the provided path.
* Remove the usage of `Function` constructor to avoid requiring 'unsafe-eval' in the Content Security Policy.
* Return `undefined` if any property in the path is not found.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/HumanSignal/label-studio/issues/7189?shareId=XXXX-XXXX-XXXX-XXXX).
@benglewis benglewis linked a pull request Mar 9, 2025 that will close this issue
Open
@benglewis
Copy link
Author

Hi all,
I've created a Pull Request to fix the issue with the help of Copilot Workspace

@heidi-humansignal
Copy link
Collaborator

Hi there,

Thanks for posting this, and for opening up the PR to help dive into this further! I'll pass this along to our team for review. We’ll evaluate this option and similar alternatives to see if they meet our performance and compatibility requirements. Your feedback is very valuable, and we’ll keep you updated as we work on this improvement.

Thanks,

Tyler Conlee
Head of Support
HumanSignal

Comment by Tyler Conlee
Workflow Run

@benglewis
Copy link
Author

@TylerConlee Is there a particular timeline in place for when this issue/PR may get attention from the development team? This is a pretty bad security flaw to be honest :/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
community_feature-request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix CSP issue by removing unsafe-eval usage benglewis/label-studio
2 participants
@benglewis @heidi-humansignal