Here it’s not wrapped inside compiler-options, is that not necessary?

see sentence below this thread

browser

and you have a namespace with a goog-define?

oh, I don’t

But if I’m setting something from the Closure library, I don’t need to explicitly define that right?

:closure-defines {goog.json.USE_NATIVE_JSON true}

yeah thats fine

looks fine to me

Weird, I’ve added it inside builds and even in every individual profile, still no luck

profile?

should be in {:builds {:build-id {:target :browser :closure-defines {goog.json.USE_NATIVE_JSON true}}} in shadow-cljs.edn

Yep, just checked, I’m able to find it there

Just to confirm, I’m checking for CLOSURE_DEFINES in the browser, if it’s undefined then that means it was not configured properly right?

again CLOSURE_DEFINES is of no concern. it is an implementation detail. forget it exists.

please instead describe what you are actually doing

you have a :target :browser build

you are loading in a HTML page somewhere?

you have a REPL into that page for the build?

it is running in an actual browser. directly without any other build tools post processing it in any way? meaning you are loading the output actually produced by shadow-cljs, not something else.

The way that it’s configured is using lein with shadow-cljs

I’m actually very new to Clojure and especially the tooling so my apologies if that’s not what you were asking for

I’m building an uberjar with lein uberjar-app

:uberjar-app {:prep-tasks [["shadow" "release" "app"]
                                "compile"]}

“app” is the build-id

ok that does a release of the app build

exactly. I assume that is a standard :advanced build. this will be optimized and no traces of the CLOSURE_DEFINES will be left. so you definitely cannot look that up there

(assuming you actually set it for the release build and not just dev)

but point is looking it up manually via CLOSURE_DEFINES in release builds is not possible

oh okay

you can do in watch or compile but not release

I was able to see it in dev so I figured the same would be possible in release as well

okay got it, but yea I’m setting it in release as well

the closure compiler will inline the value you set and then optimized

so looking up the result is kinda difficult 😛

why do you think it isn't working?

the whole purpose is to prevent closure compiler from using eval methods

cause I have a content-security-policy configured to block all eval methods

I found out online that this is the flag that actually prevents it from using eval

it should already use JSON.parse if thats available? so it won't use eval if that is available?

Hmm doesnt seem to be the case, CSP is still flagging methods for using eval in the compiled script

you can compile shadow release app --debug. that'll give you source maps and use pseudo names

that should make it much easier to find out where exactly eval is used

oh awesome, i’ll try that

been banging my head at this for hours, thank you for some direction

(it should also allow verifying the closure define actually did something

pseudo names renames stuff

so goog.json should be $goog$json

just look for that in the source code