CSP Error: Content Security Policy blocks eval() in Newspaper/td-composer

Posted in: Newspaper
Post count: 2

Description:
Hello TagDiv Support,

After enabling CSP on my site, the browser shows this error:

Content Security Policy blocks the use of ‘eval’ in JavaScript.

It looks like td-composer or some Newspaper JS files are still using eval() or new Function(). To make the site work, I would need to add ‘unsafe-eval’ in the CSP header, but this is not secure.

Can you please confirm if there is an update or patch that removes the dependency on eval() in the Newspaper theme / tagDiv Composer plugin?

I am currently using:
• Newspaper theme version: [insert version]
• tagDiv Composer version: [insert version]

I would like to know if there is a safer solution than enabling ‘unsafe-eval’ in CSP.

Thank you!

Post count: 20688

Hi,

I’ll have to check. How did you enable CSP on the website exactly, is it with a plugin? If so, please let me know which plugin.

Thanks.

Viewing 2 posts - 1 through 2 (of 2 total)
The forum ‘Newspaper’ is closed to new topics and replies.