`hasEval` detection leads to CSP warnings and reports

[tux21b]

`hasEval` detection leads to CSP warnings and reports

[flaviendelangle]

even if the undocumented option disableEval is used

Not directly the topic here but this prop is probably worth documenting since we had several feedbacks of people wanting to use it.
Having a clean doc section to link would make the process smoother

[romgrk]

Sounds good, we can evaluate hasEval lazily, so if disableEval is used it will never be evaluated.

[reihwald]

I have the same issue as @tux21b and implemented a fix in #11516

[oliviertassinari]

Does this connect back to #10329 (comment)?

[tux21b]

Does this connect back to #10329 (comment)?

I don't think so. The Content-Security-Policy doesn't mind if the eval is obfuscated via atob or if it was executed in a global scope or if it was re-assigned to another variable. It just forbids the usage of eval (unless 'unsafe-eval' is explicitly set).

[oliviertassinari]

I don't think so. The Content-Security-Policy doesn't mind if the eval is obfuscated via atob or if it was executed in a global scope or if it was re-assigned to another variable. It just forbids the usage of eval (unless 'unsafe-eval' is explicitly set).

@tux21b Ah right, without 'unsafe-eval' both eval and Function are blocked: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions.