#4212·builder

Using `eval` for detecting server code throws CSP error

Author: shimi-malka-mhCreated Dec 15, 2025Updated Dec 15, 2025

Import @builder.io/react version 8.2.9 to main index.js and just render it on a browser throws Content Security Policy of your site blocks the use of 'eval' in JavaScript even if we are not using any of the builder code and just import the builder module.

the callstack point on this

            try {
                serverOnlyRequire = eval("require")
            } catch (e) {
                serverOnlyRequire = function() {
                    return null
                }
            }

which is using eval for checking if this is server only instead of checking window is undefined first.

Can you fix it please ?