2

We are building an Assessment UI using Lightning Component. There's case were we need to validate the inputs given by the user. As part of the JSON provided by the API provider, we get "validation" node which contains the logic to validate the inputs.

sample node data:

"validation":{
   "message" : "X cannot be greater than 50 nor less than 20",
   "expression":"X > 50 || X < 20"
}

We will substitute the X with the user input and need to test the condition. Since eval is not allowed, we tried using 3rd part libraries like math.js, the thing is it works in V40. With CSP for LC Critical update active, we are getting the below error for math.js:

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' chrome-extension: https://sfdc.azureedge.net *.ap2.visual.force.com https://ssl.gstatic.com/accessibility/".

Deactivating the CSP update works fine with LC in V40.

Are there any libraries that are CSP complaint which can be used for our use-case?

3

Short of writing your own parser to evaluate the expressions, your best bet is probably to use a hidden Visualforce iframe to perform the expression evaluation. Salesforce has some detailed documentation on how to set this up.

I am not sure what the performance will be like for this setup but this should allow you to post a message to the iframe with the input value and validation expression, perform your validation in javascript hosted on the Visualforce domain (using eval() or whatever you want) then post a message back to your lightning component with the result of the expression evaluation.

  • I like the option but not sure if this approach will be flagged by the Security Review team. Also, the about the performance is indeed slow since expression evaluation needs to be carried out in multiple components. – Praveen Oct 26 '17 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.