fix(viewer): add unsafe-eval to CSP for Vue 3 runtime template compiler

jung-thomas · jung-thomas · commit f1305766751f · 2026-04-04T16:52:25.000-05:00
Vue 3 CDN build compiles in-DOM HTML templates via new Function() at
runtime. Without 'unsafe-eval' in script-src the app fails to mount.
This is unavoidable without a build step (pre-compiled SFCs).

Also adds cdn.jsdelivr.net to connect-src to suppress the browser
DevTools warning about blocked source map requests.
diff --git a/cap/app/viewer/index.html b/cap/app/viewer/index.html
@@ -4,8 +4,10 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <!-- 'unsafe-eval' required: Vue 3 CDN build compiles in-DOM templates via new Function() at runtime.
+       Remove if switching to a pre-compiled (SFC + build step) approach. -->
   <meta http-equiv="Content-Security-Policy"
-        content="default-src 'none'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; connect-src 'self'">
+        content="default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://cdn.jsdelivr.net">
   <title>Data Browser</title>
 
   <!-- Theme init: runs before body renders to avoid flash of wrong theme -->
