Content Security Policy `unsafe-eval` and `unsafe-inline` still required?
Author: joehuang-seismicCreated Jan 17, 2024Updated Jan 18, 2024
- SystemJS Version: 6.10.2
- Which library are you using?
- system.js
- s.js
- system-node.cjs
- Which extras are you using?
- AMD extra
- Named Exports
- Named Register
- Transform
- Use Default
- Global
- Dynamic Import Maps
- Are you using any custom hooks? Yes
- compiler.hooks.compilation.tap
- compilation.hooks.afterOptimizeChunks.tap
- compiler.hooks.compilation.tap
Question
I saw from this old comment https://github.com/systemjs/systemjs/issues/2172#issuecomment-612445918 that SystemJS depends on unsafe-eval and unsafe-inline CSP to work, is this still the case? If so, are there any suggestions to accommodate the removal of those CSP rules? From what I've found, it looks like eval is still in use, and we still need to apply those unsafe CSP rules. Any insights would be greatly appreciated, thanks!
Source: systemjs/systemjs