Error: call to Function() blocked by CSP

[loucyx]

CSP (content-security-policy) blocks Handlebars v2.0.0 rendering @ handlebars.js:2236

return Function.apply(this, params);

Allow 'unsafe-eval' is not an option. Is there a safe implementation of handlebars for the client side?

[kpdecker]

What version of handlebars are you referencing in the file and line reference above?

[loucyx]

Added to the post (v2.0.0).

Edit: Solved implementing precompile.

[kpdecker]

Great to hear, that was going to be my suggestion but I wanted to make sure that it was the problem that I was thinking that it was.

[qinfchen]

Is there another solution without precompile?

[loucyx]

I don't think so. Still, the precompile is a good option not only to avoid the "eval block", but also to have better performance.

[mmerezhko-hv]

Hello guys, this is not resolved. Still seeing this line in the latest version:

https://cdn.jsdelivr.net/npm/handlebars@latest/dist/handlebars.js

if (asObject) {
	      params.push(source);

	      return Function.apply(this, params);
	    } else {
	      return this.source.wrap(['function(', params.join(','), ') {\n  ', source, '}']);
	    }

So the question remains: Is there a safe implementation of handlebars for the client side?

#1934