CSP: How to allow unsafe-eval for a given URI prefix (Firefox)
问题 I'm trying to use MathJax as part of our web application which uses pretty strict Content Security Policy (CSP). The problem is that MathJax is coded to use eval() [to be exact, in form of Function() ] which is not considered safe by default by CSP. I'm using following CSP header currently: X-Content-Security-Policy: allow 'self'; img-src *; media-src *; frame-src *; font-src *; frame-ancestors 'none'; style-src *; report-uri '/:save-csp-violation'; Which causes MathJax 2.0 code to fail