Remove 'unsafe-eval' from script-src on Cloudflare
Why it matters
'unsafe-eval' lets text be run as code through eval() and similar functions, which turns many injection bugs into code execution. Most current libraries no longer need it.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: add a Response Header Transform Rule with Set static, header Content-Security-Policy-Report-Only and your current policy without 'unsafe-eval', then check the reports.
- Stage 2: after replacing the eval uses, remove 'unsafe-eval' from wherever the enforced policy is set and delete the report-only rule.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Restrict where scripts can load from
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.