Content Security Policy of your site blocks the use of 'eval' in JavaScript`

[solracsf]

Error reported by Brave browser.

Source code	Directive	Status
/apps/text/js/files.js:6	script-src	blocked

[ChristophWurst]

I've seen this same error with Nextcloud 22 RC2 and Android 8 + FF Mobile 89

Sentry CSP report

{
  "csp-report": {
    "effective_directive": "script-src",
    "blocked_uri": "eval",
    "document_uri": "https://cloud.domain.tld/apps/files/?dir=/Somethiing&openfile=449597",
    "original_policy": "default-src 'none'; base-uri 'none'; manifest-src 'self'; script-src 'nonce-XXXXXXXXXXXXXX'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.tile.openstreetmap.org; font-src 'self' data:; connect-src 'self' https://sentry.io https://stun.nextcloud:443 wss://s4.nextcloud.com; media-src 'self'; frame-src 'self'; frame-ancestors 'self'; worker-src 'self' blob:; form-action 'self'; report-uri https://sentry.io/api/2343/security/?sentry_key=YYYYYYYYYYY",
    "referrer": "",
    "violated_directive": "script-src",
    "source_file": "https://cloud.domain.tld/apps/text/js/files.js?v=3051731f-24",
    "line_number": 1,
    "column_number": 14856
  }
}

[juliusknorr]

Will check, the column_number looks at least similar to what is mentioned here:

https://github.com/webpack/webpack/issues/5627 https://github.com/webpack/webpack/blob/fb8afe71385734cfd65f47949117306a91f20753/buildin/global.js#L10

[Jolopu]

I got the same error in Brave browser with NC 22.2.6

[vinicius73]

We can not reproduce this error anymore, looks solved in newer versions.