OverlayScrollbars requires unsafe "Content Security Policy"

The current version uses eval and cannot be used with default Content-Security-Policy (http://www.w3.org/TR/CSP/, https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) headers.

Sample code:

instance.scroll("+=500px");

Browser interrupts execution here.

Known workarounds:

• Use number values (instance.scroll(500)).
• Set policy to unsafe-eval which defeats the purpose of CSP.

[KingSora]

@nuthinking Thats not possible, since the eval has its purpose. Until now eval() was called if you passed a string, but it’s not always necessary to use eval if you pass a string. You can pass simple values such as "+=100px", but you can also use units such as "+=50%", and you can even pass complex calculations such as "+=(50% - 15px) / 2".

To avoid the eval() you have to pass simple values without units (except px - its not treated as a unit, so "+=100px" is possible too) but the eval is critical if you pass numbers with units or complex calculations. The next version will work this way, so this error won’t occur with the example posted from @vobruba-martin anymore.

[KingSora]

Since there wasn’t any activity since a few months, I’ll close this issue for now. In case this problem isn’t solved like above described or the plugin isn’t usable at all, please don’t hesitate to reopen the issue.