MetaMask / MetaMask/metamask-extension
[Bug]: CSP issue related to Javascript
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
The extension on Chrome produces the following error: "Security Policy of your site blocks the use of 'eval' in JavaScript`". When deactivated and the browser rebooted, the error goes away. When activated, the error appears again.
### Expected behavior
No error in inspect mode
### Screenshots/Recordings
_No response_
### Steps to reproduce
1. Open any page in Chrome
2. Open inspect mode
### Error messages or log output
```shell
The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
Allowing string evaluation comes at the risk of inline script injection.
1 directive
Source location Directive Status
script-src blocked
```
### Version
11.16.10
### Build type
None
### Browser
Chrome
### Operating system
Windows
### Hardware wallet
_No response_
### Additional context
_No response_
### Severity
- My browser has nothing special, so I guess the error is pretty broad.
- It appears in the inspect mode for every website I visit.
Contributor guide
Research direction
Start by reproducing the error in Chrome inspect mode with the MetaMask extension enabled, then identify which extension behavior triggers the CSP violation. No source file or test is named in the issue. Done means the extension can remain enabled without producing the reported CSP eval error on inspected pages.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100