MetaMask / MetaMask/metamask-extension

[Bug]: CSP issue related to Javascript

Open
#25,354 9 comments 0 reactions 0 assignees View on GitHub
external-contributor regression-prod-11.16.10 Sev3-low team-extension-platform type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

The extension on Chrome produces the following error: "Security Policy of your site blocks the use of 'eval' in JavaScript`". When deactivated and the browser rebooted, the error goes away. When activated, the error appears again.

### Expected behavior

No error in inspect mode

### Screenshots/Recordings

_No response_

### Steps to reproduce

1. Open any page in Chrome
2. Open inspect mode

### Error messages or log output

```shell
The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
Allowing string evaluation comes at the risk of inline script injection.
1 directive
Source location Directive Status
script-src blocked
```

### Version

11.16.10

### Build type

None

### Browser

Chrome

### Operating system

Windows

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

- My browser has nothing special, so I guess the error is pretty broad.
- It appears in the inspect mode for every website I visit.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the error in Chrome inspect mode with the MetaMask extension enabled, then identify which extension behavior triggers the CSP violation. No source file or test is named in the issue. Done means the extension can remain enabled without producing the reported CSP eval error on inspected pages.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.