@cordoval your wan't eval on bundling step or in compiled code?

the trace i got in production after all the processing that webpack does, so if that is compiled there yes

@cordoval this loader use eval inside, your should search other solution for your case. Can your explain case why your use eval?

i don't use eval and eval is weak for security. This is very clear when you check what it CSP and how attackers can leverage eval() function used in script-loader to break security. My use case is just the plain usage of this script-loader. I am going to close it but this was a big warning.

I have the same issue.
I try to create an application using angular 2 and bootstrap.
Angular is using webpack for its build.
When script loader try to load the first javascript file I get this error:

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".


    at eval (<anonymous>)
    at webpackJsonp.../../../../script-loader/addScript.js.module.exports (addScript.js:9)
    at Object.../../../../script-loader/index.js!../../../../jquery/dist/jquery.slim.min.js (jquery.slim.min.js?5773:1)
    at __webpack_require__ (bootstrap c6feb7269e0a6fee60b5:54)
    at Object.2 (scripts.bundle.js:65)
    at __webpack_require__ (bootstrap c6feb7269e0a6fee60b5:54)
    at webpackJsonpCallback (bootstrap c6feb7269e0a6fee60b5:25)
    at scripts.bundle.js:1

Is there any way around it ?

the work around is not using it

I'm not sure I understand the work around.
According to security guidelines I cannot use CSP with 'unsafe-eval'
Does this mean I cannot use angular with additional scripts due to this script-loader issue ?

exactly, you need to use another thing

@cordoval can you propose what to use?

I am not sure @hotrush , i don't use this anymore, i cut it off long time ago

I'm having this issue too.

I have a legacy minified .js we have to import. script-loader works fine in most cases, except when running in an iframe in an app in Chrome OS and we get the unsafe-eval error.

I've tried using the noParse option in Webpack but that breaks the legacy file for some reason.

Has anyone found workaround?