Develop Reference

Possibly uncaught promise rejection EvalError

Even though I have added
"content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'; script-src-elem 'self' 'unsafe-inline' " },
in manifest.json (Manifest V3) I am getting the error in Chrome Extension.
What may be the reason.
Complete error: Failed to load implementation: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval'".
I attempted to follow this guide and add the "content_security_policy" tag to my manifest.json as
described in chrome documentation. But did not worked for me am I wrong or do I need to do anything else.
Thanks.

Could not set the accurate content security policy in Angular4

I am getting the following error while setting the content-security-policy.
Error:
Refused to connect to 'http://localhost:3000/articles' because it
violates the following Content Security Policy directive: "default-src
'self' 'unsafe-eval' ws:". Note that 'connect-src' was not explicitly
set, so 'default-src' is used as a fallback.
I am explaining my code below.
<meta http-equiv="Content-Security-Policy"
content="default-src 'self' 'unsafe-eval' ws:;
style-src 'self' 'unsafe-inline';
script-src 'self' http://localhost:4200 'unsafe-inline' 'unsafe-eval';">
In my code I am also connecting to json server to read/write the data into json file which run at http://localhost:3000/articles but here I am getting those related error and this is my angular4 code. I need some help to resolve this error.

If I understand your question right, I think your angular app runs on localhost:4200 and the API service on localhost:3000? This would explain why you have got that CSP warning as the request is from different source according to your current CSP configuration.
Also, ideally, the CSP should be delivered via HTTP header which means you will need some kind of server backing to support that. For example, you can have a ASP.NET app that hosts the angular app and the CSP then can be configured via web.config file.
In your case, if it's purely frontend, then perhaps you could alter your CSP setting to something like this. Hopefully it works for you.
<meta http-equiv="Content-Security-Policy"
content="default-src 'self' http://localhost:3000/ 'unsafe-eval' ws:;
style-src 'self' 'unsafe-inline';
script-src 'self' http://localhost:4200 'unsafe-inline' 'unsafe-eval';">

Changing the CSP of an Ember.js Addon Dummy App

I'm working on an ember addon leveraging PDF.js and ember-cli at version 2.18.2 and I'm noticing that PDF.js injects inline styles. The Content-Security-Policy-Report-Only header specifies style-src 'self'; which results in the logs of ember serve exploding with CSP violations being reported to the server via the report only uri with the following message:
Content Security Policy violation:
{
"csp-report": {
"document-uri": "http://localhost:4200/tests/index.html?testId=46b61910",
"referrer": "http://localhost:4200/tests/index.html",
"violated-directive": "style-src",
"effective-directive": "style-src",
"original-policy": "default-src 'none'; script-src 'self' localhost:7020 0.0.0.0:7020 undefined:7020; font-src 'self'; connect-src 'self' ws://localhost:7020 ws://0.0.0.0:7020 ws://undefined:7020 http://localhost:4200; img-src 'self'; style-src 'self'; media-src 'self'; report-uri http://localhost:4200/csp-report;",
"disposition": "report",
"blocked-uri": "inline",
"line-number": 5270,
"column-number": 23,
"source-file": "http://localhost:4200/assets/test-support.js",
"status-code": 200,
"script-sample": ""
}
}
Seeing as the applications we're building that will consume this addon control their own CSP and allows for inline styling, I'd like to disable these warnings but having difficulty tracking down how to do so.
Is it possible to customize the report-only CSP in an Ember.js addon's dummy app?

Setting CSP options is supported via the ember-cli-content-security-policy addon.
Providing the following configuration in tests/dummy/config/environment.js will prevent the usage of inline styling from having warnings reported by the console and serve logs:
module.exports = function(environment) {
var ENV = {
...
contentSecurityPolicy: {
'style-src': ["'self'", "'unsafe-inline'"],
...

visual studio 2015 cordova app and script inline for android

I've got a problem with the inline scripts on android emulator, they don't want to work.
I've already solved with the addeventlistener but now I need to add some old code and I don't want to rewrite every inline event.
Is it possible to adapt inline events for android too?

I've solved with this metatag:
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval' 'unsafe-inline' ; style-src 'self' 'unsafe-inline'; media-src *">

Meteor error: No Content-Security-Policy meta tag found. Please add one when using the cordova-plugin-whitelist plugin

I am building an app with Meteor for a couple of weeks now, without any problems. Yesterday I didn't had any problems either.
Today I wanted to continue building my app, and the terminal gives me this error every 10 seconds:
I20151208-11:19:04.463(1) (android:file:///android_asset/www/plugins/cordova-plugin-whitelist/whitelist.js:25) No Content-Security-Policy meta tag found. Please add one when using the cordova-plugin-whitelist plugin.
So I tried running another Meteor project, and got the same error.
I have googled this error, and it says I have to change the config.xml in my project. I dont know where config.xml is located in a Meteor project, but since the error is showing to ALL projects I'm trying to run, I dont think that's the solution.
Can anyone help me solve this problem?
EDIT:
I added this line in the <head> tag of my Meteor project, and in the <head> tag of my .meteor/local/cordova-build/www/index.html file:
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *">
Also, I added this to my .meteor/local/cordova-build/config.xml:
<allow-navigation href="*" />
And this to my mobile-config.js file:
App.accessRule('*');
Without success :(

Please add this code to your index.html header
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *">

Solved! Restarted my phone, and that solved the problem!