CSP error requiring `unsafe-eval`

[Edward-Upton]

Version: 1.236.5

Getting the following console error, which also causes the toolbar to fail to load.

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' <custom-proxy> https://*.posthog.com 'unsafe-inline'".

    at new Function (<anonymous>)
    at QYe.iLt (index.ts:171:26)
    at QYe.o3o (index.ts:228:45)
    at QYe.r3o (index.ts:223:44)
    at Object.code (ref.ts:18:33)
    at ohi (index.ts:532:9)
    at index.ts:228:21

Seems like a regression since it used to work. I don't think it breaks the event reporting, but does stop the toolbar from working.

The following is my (redacted) CSP config in NextJS

              default-src 'self';
              script-src 'self'<custom-proxy> https://*.posthog.com 'unsafe-inline';
              style-src 'self' <custom-proxy> https://*.posthog.com 'unsafe-inline';
              img-src 'self' <redacted> <redacted> <redacted> https://*.posthog.com data: ${process.env.NODE_ENV === 'production' ? '<redacted>' : '<redacted>'};
              connect-src 'self' <redacted>  <redacted> <custom-proxy> https://*.posthog.com;
              worker-src 'self' blob: data:;
              font-src 'self' https://*.posthog.com data:;
              media-src https://*.posthog.com;
              object-src 'none';
              base-uri 'none';
              form-action 'none';
              frame-ancestors 'none';
              upgrade-insecure-requests;

For obvious reasons, we are not happy to follow the suggestion and enable unsafe-eval

[daylon-crider]

This should have been resolved in PostHog/posthog#31697 about 2 weeks ago, but I am also getting a similar error. I cannot change CSP rules for various reasons, so there has to be another solution.

Content-Security-Policy: The page’s settings blocked a style (style-src-elem) at https://us.posthog.com/static/toolbar.css from being applied because it violates the following directive: “style-src 'self' 'unsafe-inline'”

[robbie-c]

Thanks for the report! I'll take a look and see if I can get a test running for this so we don't hit another regression

[robbie-c]

@Edward-Upton, this should be fixed PostHog/posthog#31697 and PostHog/posthog#32291, and we have a linting rule which should protect us from accidentally including another eval

@daylon-crider you will need to allow styles from https://*.posthog.com to use the toolbar's CSS.