验证时的 ExpressiveAnnotations 错误消息

Question

将 ExpressiveAnnotations (expressive.annotations.validate.js) 插入我的应用程序并触发要验证的输入后，浏览器会显示错误消息（见下文）。我不认为问题来自我的代码，而是配置问题。

我已经发现这一行（在 ExpressiveAnnotations 内）会导致问题：

ctxEval: function(exp, ctx) { // evaluates expression in the scope of context object
    return (new Function('expression', 'context', 'with(context){return eval(expression)}'))(exp, ctx); // function constructor used on purpose (a hack), for 'with' statement not to collide with strict mode, which
                                                                                                        // is applied to entire module scope (BTW 'use strict'; pragma intentionally not put to function constructor)
}

显示的错误信息：

[fail] (16:14:32): EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not a allowed source of script in the following Content Security Policy directive: "script-src 'self ''不安全的内联'"。

Answer 1

为了解决这个问题，我将 CSP 设置为以下值：

"content_security_policy": "script-src 'self' 'unsafe-eval';