Skip to content

Commit 80dbcf4

Browse files
claudeclaude
committed
docs: explain CSP 'unsafe-eval' requirement when bootstrapping older UI5 releases
The default CSP no longer contains 'unsafe-eval'. Older UI5 releases (e.g. 1.71) still execute modules via eval(), so bootstrapping them fails with an EvalError. Document the symptom and how to re-add 'unsafe-eval' via the user exit, with a warning on the security page and a pointer next to the bootstrap source table. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PHwMvvRGvLUV7CoLCB5A7e
1 parent cb05d56 commit 80dbcf4

2 files changed

Lines changed: 52 additions & 3 deletions

File tree

‎docs/configuration/security.md‎

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ The frontend is a Single-Page Application (SPA) built with SAPUI5 or OpenUI5. Th
2323
abap2UI5 never sends the app's business logic to the client. All business processes stay safely on the server, and sensitive data never reaches the frontend.
2424

2525
### Content-Security-Policy
26-
To strengthen security, abap2UI5 uses a Content Security Policy (CSP) by default. CSP blocks attacks like cross-site scripting (XSS) and data injection by restricting which resources the browser can load. The default policy allows a fixed set of trusted sources — the SAP and OpenUI5 CDNs plus jsDelivr and cdnjs; the complete policy is shown below.
26+
To strengthen security, abap2UI5 uses a Content Security Policy (CSP) by default. CSP blocks attacks like cross-site scripting (XSS) and data injection by restricting which resources the browser can load. The default policy allows a fixed set of trusted sources — the SAP and OpenUI5 CDNs plus jsDelivr and cdnjs; the complete policy is shown below. It deliberately does **not** contain `'unsafe-eval'`: current UI5 releases load all modules in a CSP-compliant way, so allowing `eval()` is unnecessary. If you bootstrap an older UI5 release, read [Bootstrapping Older UI5 Releases](#bootstrapping-older-ui5-releases) below.
2727

2828
#### Default CSP
2929
By default, abap2UI5 uses the CSP below (defined in `z2ui5_cl_exit`):
@@ -38,12 +38,57 @@ By default, abap2UI5 uses the CSP below (defined in `z2ui5_cl_exit`):
3838
```
3939

4040
#### Customizing the CSP
41-
If needed, adjust the CSP by changing the HTTP handler call:
41+
If needed, adjust the CSP in the [user exit](/advanced/extensibility/user_exits). The exit runs after the framework fills in the defaults, so whatever you set there overrides the default policy:
4242

4343
```abap
4444
METHOD z2ui5_if_exit~set_config_http_get.
4545
46-
cs_config-content_security_policy = `<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' 'unsafe-eval' ui5.sap.com *.ui5.sap.com sdk.openui5.org *.sdk.openui5.org cdn.jsdelivr.net *.cdn.jsdelivr.net"/>`.
46+
cs_config-content_security_policy = `<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' ui5.sap.com *.ui5.sap.com sdk.openui5.org *.sdk.openui5.org cdn.jsdelivr.net *.cdn.jsdelivr.net"/>`.
4747
4848
ENDMETHOD.
4949
```
50+
51+
#### Bootstrapping Older UI5 Releases
52+
Older UI5 releases (for example `1.71`, the oldest supported version) still execute fetched modules via `eval()` in their module loader. The default CSP blocks `eval()`, so bootstrapping such a release fails: the page loads, but the component cannot start and the browser console shows an error like
53+
54+
```
55+
Failed to load component for container container. Reason: EvalError: Evaluating a string as
56+
JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is
57+
not an allowed source of script: default-src 'self' 'unsafe-inline' data: ui5.sap.com ...
58+
```
59+
60+
Newer UI5 releases load modules without `eval()` and work with the default CSP out of the box — this error only appears with old releases.
61+
62+
To bootstrap an older release, override the CSP in the same exit where you set the bootstrap source and re-add `'unsafe-eval'` to `default-src` (or `script-src`). The example below is the default policy with only `'unsafe-eval'` added:
63+
64+
```abap
65+
METHOD z2ui5_if_exit~set_config_http_get.
66+
67+
cs_config-src = `https://ui5.sap.com/1.71/resources/sap-ui-core.js`.
68+
cs_config-theme = `sap_fiori_3`.
69+
70+
" old UI5 releases still execute modules via eval() - re-add 'unsafe-eval'
71+
cs_config-content_security_policy =
72+
|<meta http-equiv="Content-Security-Policy" | &&
73+
|content="default-src 'self' 'unsafe-inline' 'unsafe-eval' data: | &&
74+
|ui5.sap.com *.ui5.sap.com | &&
75+
|sapui5.hana.ondemand.com *.sapui5.hana.ondemand.com | &&
76+
|openui5.hana.ondemand.com *.openui5.hana.ondemand.com | &&
77+
|sdk.openui5.org *.sdk.openui5.org | &&
78+
|cdn.jsdelivr.net *.cdn.jsdelivr.net | &&
79+
|cdnjs.cloudflare.com *.cdnjs.cloudflare.com schemas *.schemas; | &&
80+
|connect-src 'self' | &&
81+
| ui5.sap.com *.ui5.sap.com | &&
82+
| sapui5.hana.ondemand.com *.sapui5.hana.ondemand.com | &&
83+
| openui5.hana.ondemand.com *.openui5.hana.ondemand.com | &&
84+
| sdk.openui5.org *.sdk.openui5.org | &&
85+
| cdn.jsdelivr.net *.cdn.jsdelivr.net | &&
86+
| cdnjs.cloudflare.com *.cdnjs.cloudflare.com; | &&
87+
|worker-src 'self' blob:; "/>|.
88+
89+
ENDMETHOD.
90+
```
91+
92+
::: warning
93+
`'unsafe-eval'` weakens the protection CSP provides against cross-site scripting. Only add it when you must run a UI5 release that needs it, and remove it again once you upgrade to a newer release.
94+
:::

‎docs/configuration/setup/ui5_bootstrapping.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ Without an override, abap2UI5 uses the OpenUI5 cache-buster URL — i.e. the cur
2929
| `/sap/public/bc/ui5_ui5/resources/sap-ui-core.js` | Locally hosted UI5 on the same SAP system |
3030
| `https://ui5.sap.com/1.71/resources/sap-ui-core.js` | Oldest supported version |
3131

32+
::: warning Older releases need a CSP adjustment
33+
The default Content Security Policy does not allow `eval()`, but the module loader of older UI5 releases (such as `1.71`) still relies on it. Bootstrapping such a release with the default CSP fails with an `EvalError` in the browser console ("Failed to load component for container container"). Re-add `'unsafe-eval'` to the CSP in the same exit where you set the bootstrap source — see [Bootstrapping Older UI5 Releases](/configuration/security#bootstrapping-older-ui5-releases).
34+
:::
35+
3236
### OpenUI5 vs SAPUI5
3337

3438
- **OpenUI5** (`sdk.openui5.org`) is the Apache-licensed open-source subset of UI5. It contains all libraries a typical abap2UI5 app uses: `sap.m`, `sap.ui.core`, `sap.ui.layout`, `sap.ui.table`, `sap.ui.unified`, `sap.uxap`, `sap.f`, `sap.tnt`, `sap.viz`.

0 commit comments

Comments
 (0)