Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in Content Security Pol

Question

What is the content security policy for an electron react typescript application? I'm not even using 'unsafe-eval' and I'm getting an error. Here are some Content Security Policies that I've tried and received the above error message.

--> -->

Answer 1

You are getting this error because you're trying to do an unsafe-eval, but it is disallowed by your Content Security Policy.

You should not be using unsafe-eval, hence it is named unsafe.

This means, do not call eval() or Function(), and do not pass strings to setTimeout, setInterval or setImmediate. These can leave your application vulnerable to serious security flaws, and if you don't 110% understand what you're doing, you should avoid doing these instead of getting around the error by adjusting your CSP.

---

If you absolutely must continue without heeding the above warning, you can allow unsafe-eval.

To do so, add unsafe-eval like this:

<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-eval'">