Star button throws CSP "unsafe-eval" error in browser console #59

New issue

Open

opened 2026-06-30 11:52:15 +00:00 by matthijs.vangorkom · 1 comment

matthijs.vangorkom commented

2026-06-30 11:52:15 +00:00

Description

Clicking the star button on a repository triggers a JavaScript console error and (depending on browser) the star action may not register properly.

Error message
Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'unsafe-inline'".

(https://code.overheid.nl/assets/js/index.js?v=15.0.3~gitea-1.22.0 @ 12:66499)

Steps to reproduce*

Open any repository page on this instance.
Click the "Star" button.
Open the browser console.
Observe the CSP violation error (logged twice).

Expected behavior

Starring a repo should work without triggering a CSP violation.

Actual behavior

The bundled index.js appears to call eval() or an equivalent (e.g. new Function()), which is blocked by the server's current Content-Security-Policy header since it does not include unsafe-eval in script-src.

Environment

Instance: code.overheid.nl
JS bundle version: 15.0.3~gitea-1.22.0
Browser: Vivaldi 7.9.3970.47 (Official Build) (arm64)

Possible cause

Likely a mismatch between the CSP header sent by the server/reverse proxy and what the frontend JS expects. Either the CSP needs unsafe-eval added, or the relevant frontend code should avoid using eval/new Function.

**Description** Clicking the star button on a repository triggers a JavaScript console error and (depending on browser) the star action may not register properly. **Error message** Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'unsafe-inline'". (https://code.overheid.nl/assets/js/index.js?v=15.0.3~gitea-1.22.0 @ 12:66499) *Steps to reproduce** 1. Open any repository page on this instance. 2. Click the "Star" button. 3. Open the browser console. 4. Observe the CSP violation error (logged twice). **Expected behavior** Starring a repo should work without triggering a CSP violation. **Actual behavior** The bundled `index.js` appears to call `eval()` or an equivalent (e.g. `new Function()`), which is blocked by the server's current `Content-Security-Policy` header since it does not include `unsafe-eval` in `script-src`. **Environment** - Instance: code.overheid.nl - JS bundle version: 15.0.3~gitea-1.22.0 - Browser: Vivaldi 7.9.3970.47 (Official Build) (arm64) **Possible cause** Likely a mismatch between the CSP header sent by the server/reverse proxy and what the frontend JS expects. Either the CSP needs `unsafe-eval` added, or the relevant frontend code should avoid using `eval`/`new Function`. ![image](/attachments/91a3c0d5-9156-4398-9dcf-cd923074b40a)

image.png

25 KiB