Eval() is Evil ;) (unsafe Content-Security-Policy)

[miguelgrinberg]

Eval() is Evil ;) (unsafe Content-Security-Policy)

[e2jk]

I just did it again, opening an issue without noticing #43 and #45.
However, reviewing the discussion, I still think a PR (I'll see if I can help with that) would make sense, to be able to use include_moment() just as the library is thought to be used.
I see the past discussion mentions the fact that this specific usage of eval seems unharmful (which I agree), but the problem is that if we want to use include_moment() and CSP, it means using unsafe-eval for all the scripts on the webpage, and thus potentially allowing other libraries/malicious scripts usage of eval()...

[e2jk]

Looking a bit more at the code, it seems to me that this is solvable pretty easily.
Right now the code works by generating a <span> tag with a data-timestamp and a data-format attribute.
The data-timestamp is fine (and it's content can later be retrieved and passed to the moment() function without needing eval()), but the issue comes from the data-format attribute which contains both the function and the argument(s) that need to be performed on the Moment object.

It seems to me that by separating the content of what goes now in data-format we can get rid pretty easily of the call to eval(), these would be the changes to apply to the _render() Python function:

• remove data-format
• add a new data-function that would simply be the name of the function in string format (like "format", "fromNow" or "calendar")
• add a new data-argument that would be the argument passed when the function is format, fromNow, or from (no need for arguments when the function is calendar(), valueOf() or unix())
• one last data-from-timestamp when the function is "from", since the call to from needs a second attribute to indicate the first timestamp

Then in the JavaScript code that gets generated at the bottom of include_moment():

• call moment($(elem).data('timestamp')) to get the Moment representation of the timestamp
• and then a Switch statement based on $(elem).data('function') that call the appropriate Moment JavaScript function with the $(elem).data('argument') argument (and the extra second argument $(elem).data('from-timestamp') when the function is "from"