EvalError: Refused to evaluate a string as JavaScript

[lhorie]

React-axe doesn't work when loaded in a page with strict content security policies (e.g. it throws EvalError if e.g. script-src 'self')

• Link to live demo: https://github.com/lhorie/axe-csp-bug

react-axe version: 3.0.2
axe-core version: 3.0.0

One workaround is to disable CSP rules in development, but ideally, CSP rules should be the same in dev and prod to avoid crashes if an unrelated package also abuses eval-like constructs

[WilcoFiers]

Can you raise this issue on react-axe instead? This is not an issue with the engine.
https://github.com/dequelabs/react-axe/issues/new

[lhorie]

I can but I don't believe it's an issue in react-axe.

Here's where the code throws:

// node_modules/axe-core/axe.js:1755
  'use strict';
  axe.imports['doT'] = function(module, exports, define, require, process) {
    var global = Function('return this')(); // <---

I assumed it had something to do with this:

axe-core/Gruntfile.js

Line 154 in ae2e093

file: './node_modules/dot/doT.js',

hence why I filed here

The react-axe package does not explicitly depend on doT

I also found other instances, e.g.

// node_modules/axe-core/axe.js:243
metadata.messages[prop] = new Function('return ' + metadata.messages[prop] + ';')();

which presumably comes from

axe-core/lib/core/base/audit.js

Line 306 in 6bfff2b

metadata.messages[prop] = new Function(