Call to new Function() requires unsafe-eval CSP

[Roang-zero1]

I am currently trying to roll out the latest version of the VocPlayer for the hub (https://git.cccv.de/hub/hub/-/issues/696).
Unfortunately an unsave-eval in the CSP (Content Security Polict) is still necessary in V2.01.
Unfortunately I could not find out exactly where this comes from and therefore could not make a PR.

In the minimized version the following snippet is responsible:

//# sourceURL=/microtemplates/source[` +
          Wl++ +
          "]");
      try {
        i = new Function($t.variable || "obj", "escapeExpr", a);
      } catch (l) {

[iSchluff]

I suspect that may be used by Clappr to do templating for its UI elements. Not sure what they use under the hood. If so it is probably not possible to easily get rid of it.

We are on a pretty old Clappr version, but last time we tried to update it broke a bunch of streams.

[Roang-zero1]

Ok, thanks for the answer. Then I'll assume for this event that we still have to exclude the pages from the CSP.
Then I would talk about it again post 38c3.