Make runtime work within CSP restriction.

[creationix]

In particular, I want to use regenerator to write chrome packaged apps like my tedit editor. But as soon as I tried this I realized that the runtime uses eval somewhere.

Is this a hard requirement of the runtime, or can it be modified to work without using eval (or it's variants like new Function, etc)?

I would love to use this for authoring chrome apps, but the last road-block is the runtime triggering CSP violations

[benjamn]

I think the only offending line is

regenerator/runtime/dev.js

Line 403 in df79c26

}).apply(this, Function("return [this, function GeneratorFunction(){}]")());

, which is needed to prevent the GeneratorFunction declaration from getting minified.

[creationix]

Interesting. I guess worst case I can change the runtime before including in my app. I'm not sure which minifier you're using, but isn't there a way to just specify a whitelist of identifiers to not munge (perhaps in a comment block)?

[benjamn]

Yeah, that's always possible, but it depends on particular minifier interfaces, whereas this technique works everywhere. Does CSP support comments to ignore certain code?

[creationix]

I've never heard of such a feature in CSP. I highly doubt that a comment can ever ignore valid code.

[benjamn]

I mean something like /* jslint evil: true */ (which temporarily makes jslint not complain about eval or Function).

[creationix]

No, in chrome apps, CSP is not optional. It's a hard security requirement of the platform.
I did just get regenerator working by removing the eval https://github.com/creationix/jsconfbr2014/blob/cec50ac2060dc91fd7e371f2293099bff24c02f5/app/regenerator-runtime.js#L403

[creationix]

Now with the workaround in my code from #111 https://github.com/creationix/jsconfbr2014/blob/cec50ac2060dc91fd7e371f2293099bff24c02f5/app-src/main.js and a hand modified runtime, I finally can author chrome apps on a chromebook using tedit and generators!

Here is my sample app using generators. https://github.com/creationix/jsconfbr2014/blob/cec50ac2060dc91fd7e371f2293099bff24c02f5/app-src/main.js

[benjamn]

Maybe it makes sense to recommend people use https://github.com/facebook/regenerator/blob/master/runtime/min.js, and just make sure GeneratorFunction doesn't get minified in that file.

[benjamn]

Idea from benjamn/ast-types#72 (comment): either don't minify https://github.com/facebook/regenerator/blob/master/runtime.js, or make sure you minify it in such a way that GeneratorFunction does not get renamed. The latter requirement can be enforced by an assertion in https://github.com/facebook/regenerator/blob/master/runtime.js.

[fkling]

@benjamn: Are you comparing the name so that the check works in environments that natively support generators (and GeneratorFunction)? Wouldn't

  runtime.isGeneratorFunction = function(genFun) {
    var ctor = genFun && genFun.constructor;
    return ctor ? 'GeneratorFunction' === ctor.name || ctor === GeneratorFunction : false;
  };

work well enough?