[GH-ISSUE #4100] [bug]: (sh-desktop) Javascript - Security issue? #1467

New issue

Closed

opened 2026-03-16 20:25:52 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 20:25:52 +03:00

Owner

Originally created by @ImNicolasTheDev on GitHub (Jun 3, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4100

Is there an existing issue for this?

I have searched the existing issues

Current behavior

Version : hoppscotch-release-2024.3.2

After building and installing the hoppscotch-seflhost-desktop app, when I run it, it just loads indefinitely.
Looking in the console, I see some errors :

First error message:

Error compiling schema, function code: const schema2 = scope.schema[2];const schema1 = scope.schema[1];return function validate1(data, {instancePath="", parentData, parentDataProperty, rootData=data}={}){let vErrors = null;let errors = 0;if(!(((typeof data == "number") && (!(data % 1) && !isNaN(data))) && (isFinite(data)))){const err0 = {instancePath,schemaPath:"#/definitions/nonNegativeInteger/type",keyword:"type",params:{type: "integer"},message:"must be integer"};if(vErrors === null){vErrors = [err0];}else {vErrors.push(err0);}errors++;}if((typeof data == "number") && (isFinite(data))){if(data < 0 || isNaN(data)){const err1 = {instancePath,schemaPath:"#/definitions/nonNegativeInteger/minimum",keyword:"minimum",params:{comparison: ">=", limit: 0},message:"must be >= 0"};if(vErrors === null){vErrors = [err1];}else {vErrors.push(err1);}errors++;}}validate1.errors = vErrors;return errors === 0;}

Second error message:

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-L1BiSP9EZ8uu5cyWzhX3FA4nx0K8Ei7hY0DYbI3+d2k=' 'sha256-voK8dMbXMWHIkWfrlQcCuVPIqF1og3nDiZjB+2HS+so=' [...]"
    at new Function (<anonymous>)
    at a.v2 (insomnia-36e3e2d1.js:19:26956)
    at a.wH (insomnia-36e3e2d1.js:19:28129)
    at a._H (insomnia-36e3e2d1.js:19:28005)
    at Object.code (insomnia-36e3e2d1.js:19:61843)
    at CR (insomnia-36e3e2d1.js:19:23725)
    at insomnia-36e3e2d1.js:19:18790
    at k.code (insomnia-36e3e2d1.js:16:926)
    at k.block (insomnia-36e3e2d1.js:16:2846)
    at O$ (insomnia-36e3e2d1.js:19:18780)
G @ index-b961524a.js:139

While searching for more information, I saw that the second error message could be related to the fact that the script uses eval to evaluate a string, which is a security issue (see this issue). I tried then to remove the vue-pdf-embed dependency, and their usage, but still caught these errors.

Any help is appreciated! 😄

Steps to reproduce

Clone the repo (version: hoppscotch-release-2024.3.2)
Add the missing line "@hoppscotch/data": "workspace:^", to ./packages/hoppscotch-selfhost-desktop/package.json
Run pnpm install, and pnpm tauri build
Install the generated *.exe
See console logs

Environment

Production

Version

Self-hosted

Originally created by @ImNicolasTheDev on GitHub (Jun 3, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4100 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior *Version : hoppscotch-release-2024.3.2* After building and installing the **hoppscotch-seflhost-desktop** app, when I run it, it just loads indefinitely. Looking in the console, I see some errors : First error message: ``` Error compiling schema, function code: const schema2 = scope.schema[2];const schema1 = scope.schema[1];return function validate1(data, {instancePath="", parentData, parentDataProperty, rootData=data}={}){let vErrors = null;let errors = 0;if(!(((typeof data == "number") && (!(data % 1) && !isNaN(data))) && (isFinite(data)))){const err0 = {instancePath,schemaPath:"#/definitions/nonNegativeInteger/type",keyword:"type",params:{type: "integer"},message:"must be integer"};if(vErrors === null){vErrors = [err0];}else {vErrors.push(err0);}errors++;}if((typeof data == "number") && (isFinite(data))){if(data < 0 || isNaN(data)){const err1 = {instancePath,schemaPath:"#/definitions/nonNegativeInteger/minimum",keyword:"minimum",params:{comparison: ">=", limit: 0},message:"must be >= 0"};if(vErrors === null){vErrors = [err1];}else {vErrors.push(err1);}errors++;}}validate1.errors = vErrors;return errors === 0;} ``` Second error message: ``` EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-L1BiSP9EZ8uu5cyWzhX3FA4nx0K8Ei7hY0DYbI3+d2k=' 'sha256-voK8dMbXMWHIkWfrlQcCuVPIqF1og3nDiZjB+2HS+so=' [...]" at new Function (<anonymous>) at a.v2 (insomnia-36e3e2d1.js:19:26956) at a.wH (insomnia-36e3e2d1.js:19:28129) at a._H (insomnia-36e3e2d1.js:19:28005) at Object.code (insomnia-36e3e2d1.js:19:61843) at CR (insomnia-36e3e2d1.js:19:23725) at insomnia-36e3e2d1.js:19:18790 at k.code (insomnia-36e3e2d1.js:16:926) at k.block (insomnia-36e3e2d1.js:16:2846) at O$ (insomnia-36e3e2d1.js:19:18780) G @ index-b961524a.js:139 ``` While searching for more information, I saw that the second error message could be related to the fact that the script uses ``eval`` to evaluate a string, which is a security issue (see [this issue](https://github.com/mozilla/pdf.js/issues/16061#issuecomment-1431872557)). I tried then to remove the ``vue-pdf-embed`` dependency, and their usage, but still caught these errors. Any help is appreciated! 😄 ### Steps to reproduce 1. Clone the repo (version: *hoppscotch-release-2024.3.2*) 2. Add the missing line ``"@hoppscotch/data": "workspace:^",`` to ``./packages/hoppscotch-selfhost-desktop/package.json`` 3. Run ``pnpm install``, and ``pnpm tauri build`` 4. Install the generated **.exe* 5. See console logs ### Environment Production ### Version Self-hosted

kerem

2026-03-16 20:25:52 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 20:26:13 +03:00

Author

Owner

@ImNicolasTheDev commented on GitHub (Jun 3, 2024):

Here is a screenshot if needed.

@ImNicolasTheDev commented on GitHub (Jun 3, 2024): ![image](https://github.com/hoppscotch/hoppscotch/assets/112523931/a2d34bf2-4705-40b3-9e90-5e3404a08e49) Here is a screenshot if needed.

kerem referenced this issue

2026-03-17 00:57:26 +03:00

[PR #1467] [CLOSED] chore(deps): bump firebase from 8.2.5 to 8.2.6 #3332