CSP script-src violations #1494
Description
I try to implement Content Security Policy on a game written using Phaser.js in Cordova for mobile.
I have my security rules set pretty ok:
Content-Security-Policy: default-src 'self';
script-src 'self' *.example.com *.google-analytics.com mc.yandex.ru;
style-src *.example.com;
img-src 'self' *.example.com;
frame-src *.example.com;
connect-src *.example.com ws://api.example.com wss://api.example.com"Where example.com is some hosting i use to do some back-end logic and statistics.
However Chrome shows me next errors:
- Refused to evaluate a string as JavaScript because
'unsafe-eval'is not an allowed source of script in the following Content Security Policy directive: "script-src...
phaser.js:34155 ... phaser.js:70453 - Refused to evaluate a string as JavaScript because
'unsafe-eval'is not an allowed source of script in the following Content Security Policy directive: "script-src...
phaser.js:34155 ... phaser.js:70453
Here's the code:
// The accessor creates a new Signal (and so it should only be used from user-code.)
Object.defineProperty(Phaser.Events.prototype, prop, {
get: new Function("return "+backing+" || ("+backing+" = new Phaser.Signal())") //line 34155
});
...
}).call(this); //line 70453 I don't really want to use 'unsafe-eval' for script-src, especially since it is not recommended.
Please read Content Security Policy Specs for more information.