通过 splash 评估 javascript 时如何避免 CSP 错误？

Question

我正在从“https://www.welcometothejungle.com/en”抓取数据

  function main(splash, args)
  assert(splash:go(args.url))
  assert(splash:wait(0.5))
  assert(splash:runjs('document.querySelector("#sticky-menu a[data-testid=menu-jobs]").click()'))
  splash:set_viewport_full()
  return {
    html = splash:html(),
    png = splash:png(),
    har = splash:har(),
  }
  end

我遇到了这个错误 JS 错误：'EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not a allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline' cdn.welcometothejungle.co

 {
"error": 400,
"type": "ScriptError",
"description": "Error happened while executing Lua script",
"info": {
    "source": "[string \"function main(splash, args)\r...\"]",
    "line_number": 4,
    "error": "JS error: 'EvalError: Refused to evaluate a string as JavaScript because \\'unsafe-eval\\' is not an allowed source of script in the following Content Security Policy directive: \"script-src \\'unsafe-inline\\' cdn.welcometothejungle.co platform.linkedin.com www.linkedin.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com connect.facebook.net www.facebook.com www.youtube.com *.ytimg.com loader.wisepops.com app.wisepops.com cdn.wisepops.com optimize.google.com app.getbeamer.com realtime.getbeamer.com player.vimeo.com speakerdeck.com www.slideshare.net talks.golang.org docs.google.com slides.com static.hotjar.com script.hotjar.com *.batch.com polyfill.io *.axept.io\".\\n'",
    "type": "LUA_ERROR",
    "message": "Lua error: [string \"function main(splash, args)\r...\"]:4: JS error: 'EvalError: 
       Refused to evaluate a string as JavaScript because \\'unsafe-eval\\' is not an allowed source of 
       script in the following Content Security Policy directive: \"script-src \\'unsafe-inline\\' 
       cdn.welcometothejungle.co platform.linkedin.com www.linkedin.com www.googletagmanager.com 
       tagmanager.google.com www.google-analytics.com connect.facebook.net www.facebook.com 
       www.youtube.com *.ytimg.com loader.wisepops.com app.wisepops.com cdn.wisepops.com 
       optimize.google.com app.getbeamer.com realtime.getbeamer.com player.vimeo.com speakerdeck.com 
       www.slideshare.net talks.golang.org docs.google.com slides.com static.hotjar.com 
       script.hotjar.com *.batch.com polyfill.io *.axept.io\".\\n'"
         }
       }

Answer 1

错误 JS 错误：'EvalError: 拒绝将字符串评估为 JavaScript，因为在以下内容安全策略指令中，'unsafe-eval' 不是允许的脚本来源：“script-src 'unsafe-inline' cdn.welcometothejungle .co ...

这个错误是由assert(splash:runjs('document.querySelector("#sticky-menu a[data-testid=menu-jobs]").click()'))引起的

splash:runjs('string') 内部调用 evaljs('string') -> 调用原生 JavaScript 的 eval() func 将字符串转换为 JS代码。

内容安全政策禁止在script-src 指令中使用没有'unsafe-eval' 标记的JavaScript eval 表达式。

您必须将'unsafe-eval' 令牌添加到script-src：

"script-src 'unsafe-inline' 'unsafe-eval' cdn.welcometothejungle.co platform.linkedin.com
www.linkedin.com www.googletagmanager.com tagmanager.google.com
www.google-analytics.com connect.facebook.net www.facebook.com www.youtube.com
*.ytimg.com loader.wisepops.com app.wisepops.com cdn.wisepops.com
optimize.google.com app.getbeamer.com realtime.getbeamer.com player.vimeo.com
speakerdeck.com www.slideshare.net talks.golang.org docs.google.com slides.com
static.hotjar.com  script.hotjar.com *.batch.com polyfill.io *.axept.io"