Is there a way to use this library in a browser without adding 'wasm-unsafe-eval' to the CSP?

[ymor]

I noticed that the library does seem to build with -s DYNAMIC_EXECUTION=0 however I'm still receiving the following error in the browser when using the barcode-detector library.

Aborted(CompileError: WebAssembly.instantiate(): Compiling or instantiating WebAssembly module violates the following Content Security policy directive because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: )

Is there anything else I could do or something the library could do?

[Sec-ant]

Check: https://github.com/Sec-ant/zxing-wasm?tab=readme-ov-file#configuring-wasm-serving

[ymor]

Thanks for the reply. I'm already setting the locateFile and serving it from my app. Or should I be looking at instantiateWasm too?

[ymor]

Ok so from what I understand. It seems that to instantiate/load any wasm file you currently need wasm-unsafe-eval and if that wasm file then had any eval() or new Function then you would also need unsafe-eval.
DYNAMIC_EXECUTION=0 basically remove the need for the latter (unsafe eval). But wasm-unsafe-eval is still required regardless https://www.w3.org/TR/CSP3/#can-compile-wasm-bytes

[Sec-ant]

Ok so from what I understand. It seems that to instantiate/load any wasm file you currently need wasm-unsafe-eval and if that wasm file then had any eval() or new Function then you would also need unsafe-eval.
DYNAMIC_EXECUTION=0 basically remove the need for the latter (unsafe eval). But wasm-unsafe-eval is still required regardless https://www.w3.org/TR/CSP3/#can-compile-wasm-bytes

Yes, you're right. I think I should add this piece in the FAQ section of the README.