FEAT: Support Content-Security-Policy

To reduce the possible attack surface if the editor is used in “hostile” environments (e.g. in SaaS platforms) support for CSP is required. This will also prevent problems like https://github.com/artf/grapesjs/issues/3082

At the moment, the only problem that prevents effective CSP rules is the use of new Function() in the GrapesJS code, which requires a CSP rule of unsafe-eval.

Is there a different way to implement that?

[artf]

ok then, I’ll try to fix it for the next release.

[aimeos]

@artf Guess, browsers block certain dynamic function declarations (new Function('<string>')) and function calls / language constructs (e.g. eval) when CSP is activated.