or
1 answer
17 views
Is the following error because kendo is using eval() in some areas?
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://maps.googleapis.com 'sha256-FCclJ10YV/xEc9PbnYcWzMs7Mw9DRGVf31pHhGF1jtp='".
at Function (<anonymous>)
at Object.getter (kendo.all.min.js:26:455)
at init.get (kendo.all.min.js:27:21790)
at new e (ScheduleDsb.tsx:367:30)
at 125 (DyScheduleTimeline.tsx:67:46)
at i (scheduler:1:1815)
at r (scheduler:1:1684)
at Array.t [as push] (scheduler:1:1547)
at main.358cb176.chunk.js:1:73
getter @ kendo.all.min.js:26
get @ kendo.all.min.js:27
e @ ScheduleDsb.tsx:367
125 @ ScheduleTimeline.tsx:67
i @ scheduler:1
r @ scheduler:1
t @ scheduler:1
(anonymous) @ main.358cb176.chunk.js:1Following are some details on the version we are using.
"dependencies": {
"@progress/kendo-ui": "^2021.3.1207",
"@types/node": "^12.20.15",
"@types/react": "^17.0.11",
"moment": "^2.29.4",
"react": "^17.0.2",
.
.
.
}
"devDependencies": {
"@types/jquery": "^3.5.5",
.
.
.
}
Vessy
Telerik team
answered
on
08 Apr 2024
1 answer
60 views
I'm attempting to use kendo-charts but when applying a strict content security policy there are many CSP violations regarding style-src.
This appears to be related to the file render-svg.js, in particular the attempt to set innerHTML:
var renderSVG = function(container, svg) {
container.innerHTML = svg;
};
Is there any way to avoid this? We cannot set 'unsafe-inline' for the entire application.
Thanks.
