Tesseract.js requires `script-src: eval` CSP

[ClearlyClaire]

Tesseract 2.0.0-beta.2 fails to run with:

Content Security Policy: The page’s settings blocked the loading of a resource at eval (“script-src”).

This is a regression from 2.0.0-alpha.16.

This is caused by the line Function("r", "regeneratorRuntime = r")(runtime); introduced by facebook/regenerator@063f14e in the regenerator module

I suspect this may have been introduced in Tesseract.js by 8e73c8d but I haven't actually checked yet.

[nightpool]

  // strict mode using a global Function call. This could conceivably fail
  // if a Content Security Policy forbids using Function, but in that case
  // the proper solution is to fix the accidental strict mode problem. If
  // you've misconfigured your bundler to force strict mode and applied a
  // CSP to forbid Function, and you're not willing to fix either of those
  // problems, please detail your unique predicament in a GitHub issue.

does this mean that some part of the way tesseract is using regenerator is incorrect?

[ClearlyClaire]

My understanding is that regenerator isn't supposed to work at all in strict mode (and thus try escaping it), and that it is used through babel. I don't know if there is a way around that while still using babel.

[nightpool]

@ThibG that doesn't make any sense to me, regenerator runtime used to be part of babel

[ClearlyClaire]

In fact I was wrong, since 4100c0e Tesseract is directly requiring regenerator-runtime and I'm not sure why.
In any case, regenerator-runtime currently can't be used in strict mode, and will try to escape it, which is causing the issue at hand.

[ClearlyClaire]

After updating Tesseract.js to latest version and rewriting the corresponding code, I do not have this issue anymore. I don't have the original code causing this anymore, but I suspect babel somehow rewrote the tesseract.js-core files.