Using `eval` for detecting server code throws CSP error
Author: shimi-malka-mhCreated Dec 15, 2025Updated Dec 15, 2025
Import @builder.io/react version 8.2.9 to main index.js and just render it on a browser throws
Content Security Policy of your site blocks the use of 'eval' in JavaScript
even if we are not using any of the builder code and just import the builder module.
the callstack point on this
try {
serverOnlyRequire = eval("require")
} catch (e) {
serverOnlyRequire = function() {
return null
}
}which is using eval for checking if this is server only instead of checking window is undefined first.
Can you fix it please ?
Source: BuilderIO/builder