Swagger-ui appears to require 'unsafe-eval' in CSP Headers

Q&A (please complete the following information)

• OS: [MacOS v10.14.5] but really N/A
• Browser: [Chrome] (or any modern browser)
• Version: [Version 79.0.3945.130 (Official Build) (64-bit)]
• Method of installation: [maven via org.webjars::swagger-ui]
• Swagger-UI version: [3.22.1]
• Swagger/OpenAPI version: [e.g. Swagger 2.0, OpenAPI 3.0]

Content & configuration

Here's a quick image of the console error:

Here's a detailed callstack if I break on the thrown error:
`

Describe the bug you're encountering

Quite simply: if my nginx configuration is set to exclude 'unsafe-eval' for the 'script-src' directive of the Content-Security-Policy, the Swagger-UI is choking due to an error - in this case specifically due to the usage of new Function(...) which relies on eval to execute at runtime (not the best practice).

I've cloned the git repo and looked at the code in your "src" directory and do not see any offending usages of calls to new Function constructors. It does, however, turn up a number of matches inside the "dist" director including the "swagger-ui-bundle.js". Unfortunately this suggests the code is being included in from 3rd party npm dependencies bundled via webpack.

To reproduce...

Steps to reproduce the behavior:

1. swagger is being deployed behind nginx. The nginx server block in the config contains something like this:
   server { ... location /swagger { ... add_header Content-Security-Policy "default-src 'self'; script-src 'self';" always; ... }
   which explicitly does not have the 'unsafe-eval' option enabled.

2. Load swagger in your browser: https://<ip-address>/swagger

3. Scroll down to some API endpoint e.g. "Foo" and click to expand it

4. Scroll to any specific request option: e.g. GET /foo and click to expend it

Expected behavior

Expect the UI view to expand open to view documentation detail, model definitions, and the typical "try it out" button to execute an interactive request against the api

Actual - a small section expands down but is empty. The only way to see that something is wrong is inside the browser console. which throws the error regarding blocked eval for Function

Screenshots

Additional context or thoughts

Reproduce the issue behind the shown nginx Content-Security-Policy and inspect the new Function matches in dist/swagger-ui-bundle.js. Trace the actions.js:224 call through the bundled dependency and compare it with the available source under src. Done means expanding an endpoint works without requiring unsafe-eval.