Search code examples
breezecontent-security-policy

Breeze JS errors with Content Security Policy

With Breeze JS and a strict Content Security Policy I get the error Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive.

Is there a way to fallback without 'unsafe-eval' the same way AngularJS does with https://docs.angularjs.org/api/ng/directive/ngCsp?

Solution

  • Breeze uses Function(string) in order to make constructor functions for entities that have the same name as the entity. This is purely to make debugging easier, and is not an essential feature.

    It should be possible to remove the reliance on Function(string) in the next version of Breeze. In the meantime, you can patch your version using:

    function createEmptyCtor(type) {
    return function(){};
}

    Or minified as in your comment above:

    function t(e) { return function(){}; }