Skip to content

eval usage is not allowed when using a sensible CSP #106

Closed
@buesing

Description

I recently added a content security policy to my site and now I'm seeing this error:
nextZero EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob:".. It's because this library is using an eval call here:

result[key] = eval(value.replace(/^BIC_FN:::/, ''))

I'm wondering if this can be rewritten to use a different parsing strategy. Using eval is generally discouraged.

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions