Content security policy (CSP) violation using nunjucks browser compiled files

When using the webpack compiled files in the browser, a CSP violation is triggered when eval is disallowed, due to a webpack generated code snippet:

// This works in non-strict mode
g = (function () {
    return this;
})();

try {
    // This works if eval is allowed (see CSP)
    g = g || Function('return this')() || (1, eval)('this');
} catch (e) {
    // This works if the window reference is available
    if (typeof window === 'object') g = window;
}

Nunjucks will still work due to the fallback to window. It is however not very nice to have those policy violation reports arriving at the CSP report-uri.

This snippet is present in the npm package browser files: node_modules/nunjucks/browser/nunjucks.js node_modules/nunjucks/browser/nunjucks-slim.js

For a possible solution on this issue, see: https://github.com/webpack/webpack/issues/5627#issuecomment-394290231