Cannot disable unsafe-eval

  • I have been hired to implement a CSP for a web site that uses the Mailchimp for WooCommerce plugin.

    If I disable unsafe-eval, the site reports an error in mailchimp-woocommerce-public.min.js?ver=4.1.07:

    Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' blob .....

    Is there a workaround for this?

Viewing 9 replies - 1 through 9 (of 9 total)
  • Plugin Author ryanhungate

    (@ryanhungate)

    @mikemackechnie are you having trouble with the mailchimp.com or the “chimpstatic” domains? You’re bringing up a very good point that we’ll be glad to get resolved if possible.

    Thread Starter mikemackechnie

    (@mikemackechnie)

    It’s https://chimpstatic.com/ in my Content Security Policy.

    We are now running version 4.2.1 of the plugin, but we are still getting the problem.

    Plugin Support khungate

    (@khungate)

    Hi @mikemackechnie thanks for your patience. We wanted to let you know we escalated this issue to the proper channels shortly after your last message, and are awaiting further guidance from the team that works with this particular script at Mailchimp. We’ll update this thread as soon as we know more information.

    Hi,

    I am testing CSP for a client and noticed it didn’t like the first setTimeout function in the file:

     ./plugins/mailchimp-for-woocommerce/public/js/mailchimp-woocommerce-public.min.js

    Changing from:

    mailchimpReady=function(e){/in/.test(document.readyState)?setTimeout("mailchimpReady("+e+")",9):e()}

    to:

    mailchimpReady=function(e){/in/.test(document.readyState)?setTimeout(() => "mailchimpReady("+e+")",9):e()}

    seemed to work, possibly caused by this functionality…

    https://stackoverflow.com/questions/72061796/using-settimeout-with-strings-triggers-unsafe-eval-alert

    KJ

    (@kjvextras)

    That’s great news! Do you need anything else from us? We are still looking into things on our side.

    Thanks, modifying the js file on an ad-hoc basis is not my preferred approach but personally I can wait until you resolve it. I can’t speak for @mikemackechnie

    KJ

    (@kjvextras)

    Thanks so much for being patient with us @alibuc – This update is in our next release. We will swing back around to let you know when deployed. Chat soon!

    Thread Starter mikemackechnie

    (@mikemackechnie)

    Good news! I have applied @alibuc ‘s edit to the js and I can confirm that I can now disable unsafe-eval on my website. Good work @alibuc .

    KJ

    (@kjvextras)

    Heck yea! So happy things worked out – We appreciate you swinging back around and letting us know. Thanks for sticking with us! @mikemackechnie

Viewing 9 replies - 1 through 9 (of 9 total)
  • You must be logged in to reply to this topic.