Content Security Policy: Uncaught EvalError

Uncaught EvalError: Refused to evaluate a string as JavaScript because ‘unsafe-eval’ is not an allowed source of script in the following Content Security Policy directive: “script-src ‘self’ blob: filesystem:”.

I’m using EJS to render templates in a Browser Extension and the use of new Function("return this;") is throwing a CSP error. I’m building from the npm package, but looked into the client side distribution and noticed the same eval occurs there as well. (https://github.com/mde/ejs/blob/v2.6.2/lib/ejs.js#L106)

Here’s an example of a fix that works in the browser extension context. I’d be happy to open a PR and validate the fix in the context if it’s an acceptable change.

[morasumu]

I’m still running into the same issue… Is there any update?

[ExE-Boss]

That won’t work in this case, because EJS works by transpiling the .ejs file into a JavaScript function at runtime.