1. Home
  2. Forum
  3. React - EJ 2
  4. Resizing columns/rows result in unsafe-eval is not an allowed CSP errors

Resizing columns/rows result in unsafe-eval is not an allowed CSP errors

I'm using the React Spreadsheet component. When I try to resize a column/row I get this error in the Javascript console:


Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".


I don't want to add `unsafe-eval` to my script-src CSP as it will introduce security holes.

Is there any other way to overcome this issue?


2 Replies
JS Janakiraman Sakthivel Syncfusion Team January 8, 2025 03:24 PM UTC

Hi Tim Law,

We have confirmed the issue as "Unsafe-eval error on column/row resize in spreadsheet after implementing Content Security Policy" and logged a bug report and it will be available in our January 21 patch release. We appreciate your patience in the meantime. You can track the status of the issue via the feedback link below.

Feedback link for tracking purpose: https://www.syncfusion.com/feedback/64517/unsafe-eval-error-on-column-row-resize-in-spreadsheet-after-implementing-content

Disclaimer: "Inclusion of this solution in the weekly release may change due to other factors including but not limited to QA checks and works re prioritization".


JS Janakiraman Sakthivel Syncfusion Team January 21, 2025 07:17 PM UTC

Hi Tim Law,

We are glad to announce that our weekly patch release (28.1.41) is rolled out. And we have included the fix for the reported "Unsafe-eval error on column/row resize in spreadsheet after implementing Content Security Policy" issue in this release. So, kindly upgrade your package version to the latest to avail of these changes (28.1.41).

Package Link: @syncfusion/ej2-react-spreadsheet - npm

Feedback Link: https://www.syncfusion.com/feedback/64517/unsafe-eval-error-on-column-row-resize-in-spreadsheet-after-implementing-content
 
Root cause:
The root cause of the problem is that string values are being used directly in the tooltip's content property within the source resize module.


Solution Description:
The direct string in the tooltip's content property within the resize module has now been replaced with function template values. As a result, the uncaught issue is no longer thrown in the console, and the tooltip functions correctly when resizing columns and rows, both with and without meta tags that include CSP.

Please let us know if you need further assistance on this.


Loader.
Up arrow icon