Q:

Content Security Policy (CSP) block eval method call

I am using nicEditor and in nicEditor there is a method called eval that is blocked by CSP. When I comment out the CSP code, it's working fine.
Error: call to eval() blocked by CSP     nicEdit.js:779:36

My CSP code:
scriptSrc: ["'self'", "'unsafe-inline'"]

I also read https://developer.chrome.com/extensions/contentSecurityPolicy
Thanks in advance

A:

If you really need to use nicEditor which contains eval (which is probably not a good idea in the first place), you can add the following directive: 'unsafe-eval'
I would really, really, recommend that you simply use a different editor which doesn't rely on eval though. It really is a security risk in most cases.
If you need an alternative, have a look at ProseMirror for example.

