Hi There,
We are implementing the Content Security Policy(CSP) in our Envoy Application.
We have allowed all the resources from Zendesk as valid resource in CSP rule. But unfortunatly we are getting below error on clock on Chat widget.
Error:
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src *.zdassets.com *.zendesk.com"
We are getting this error from the JS file "https://static.zdassets.com/web_widget/latest/classic/web-widget-8663-7c2ace3.js" at line number : 4930.
try {
return Function('"use strict"; return (' + e + ").constructor;")()
}
Accourdting to the CSP best practices, we cannot use unsafe-eval, instead we need to use alternative for eval() or funtion() in JS.
Can you please provide us the solution for this as this is become a major security issue.
We have followed the
https://developer.zendesk.com/documentation/classic-web-widget-sdks/web-widget/integrating-with-google/csp/#content-security-policy-csp-support
Thanks for sharing this within the Community! We adhere to Google's Strict CSP guidelines which can be found here. Based on their strict guidelines, 'unsafe-eval' is an allowed CSP keyword. Their recommendation is that if eval() is not used than you can omit it for increased security. Having it would not violate the Strict CSP.
However, taking a further look into our newest Web Widget Classic version you should be able to omit it as it doesn't appear we're using eval. Would you be able to share your current Web Widget snippet and CSP setup?
Best,
Erica