汇总再生器运行时与 Chrome 应用 CSP 冲突

如何解决汇总再生器运行时与 Chrome 应用 CSP 冲突

我目前正在尝试将一些自定义软件包及其依赖项捆绑到一个用于我的 Chrome app 的 UMD 文件中。我已使用 Rollup 正确捆绑了我的代码，但我的捆绑代码与 Chrome 应用程序之间遇到了 Content Security Policy 冲突。

问题似乎来自 2 个不同的区域，都是通过 unsafe-eval 构造函数造成的 Function 违规。

问题 1
@rollup/plugin-commonjs 模块构建了一个 GLOBAL commonjs 模块

var GLOBAL = createCommonjsModule$1(function (module,exports) {

exports.__esModule = true; // Reference to the global context (works on ES3 and ES5-strict mode)
// jshint -W061,-W064

exports["default"] = Function('return this')();
});

问题 2
regenerator runtime 问题（对我的确切问题进行了不幸的评论）

try {
    regeneratorRuntime = runtime;
} catch (accidentalStrictMode) {
    // This module should not be running in strict mode,so the above
    // assignment should always work unless something is misconfigured. Just
    // in case runtime.js accidentally runs in strict mode,we can escape
    // strict mode using a global Function call. This Could conceivably fail
    // if a Content Security Policy forbids using Function,but in that case
    // the proper solution is to fix the accidental strict mode problem. If
    // you've misconfigured your bundler to force strict mode and applied a
    // CSP to forbid Function,and you're not willing to fix either of those
    // problems,please detail your unique predicament in a GitHub issue.
    Function("r","regeneratorRuntime = r")(runtime);
}

建议的解决方案（removing strict mode 或 changing CSP）无法解决的问题

这是我当前的 rollup.config.js 文件以供参考

import resolve from '@rollup/plugin-node-resolve';
import babel from '@rollup/plugin-babel';
import commonjs from '@rollup/plugin-commonjs';

export default {
  input: 'src/index.js',output: {
    strict: false,file: 'dist/index.js',format: 'umd',},plugins: [
    babel({ babelHelpers: 'bundled' }),resolve({
      browser: true,mainFields: ['main'],// This default doesnt work :/
      preferBuiltins: true,}),commonjs(),],};