This issue is about google-protobuf@3.12.4 js package, as published on npm.
Currently, it contains the following files:
./README.md
./google-protobuf.js
./package.json
./google/protobuf/any_pb.js
./google/protobuf/empty_pb.js
./google/protobuf/descriptor_pb.js
./google/protobuf/field_mask_pb.js
./google/protobuf/type_pb.js
./google/protobuf/duration_pb.js
./google/protobuf/source_context_pb.js
./google/protobuf/struct_pb.js
./google/protobuf/api_pb.js
./google/protobuf/compiler/plugin_pb.js
./google/protobuf/timestamp_pb.js
./google/protobuf/wrappers_pb.js
./google/ protocols are built in commonjs mode as opposed to commonjs_strict, which makes them both pollute the global scope (they create a global proto variable) and not compatible with CSP (they use Function constructor):
var jspb = require('google-protobuf');
var goog = jspb;
var global = Function('return this')();
goog.exportSymbol('proto.google.protobuf.Any', null, global);
/**
* Generated by JsPbCodeGenerator.
* @param {Array=} opt_data Optional initial data array, typically from a
* server response, or constructed directly in Javascript. The array is used
* in place and becomes part of the constructed object. It is not cloned.
* If no data is provided, the constructed object will be empty, but still
* valid.
* @extends {jspb.Message}
* @constructor
*/
proto.google.protobuf.Any = function(opt_data) {I would have expected commonjs_strict protocols to be present there, either under the same folder, or perhaps in a separate google/protobuf.strict or strict/google/protobuf directory.
That would make them usable in commonjs_strict mode.
This issue is about
google-protobuf@3.12.4js package, as published on npm.Currently, it contains the following files:
./google/protocols are built incommonjsmode as opposed tocommonjs_strict, which makes them both pollute the global scope (they create a globalprotovariable) and not compatible with CSP (they useFunctionconstructor):I would have expected
commonjs_strictprotocols to be present there, either under the same folder, or perhaps in a separategoogle/protobuf.strictorstrict/google/protobufdirectory.That would make them usable in
commonjs_strictmode.