CSP violation 'script-src' 'unsafe-eval' in web-component and standalone package in angular

[mbmwlr]

Description
We are trying to implement the asyncapi renderer within an Angular application.
When adding a Content Security Policy limiting the 'script-src' to 'self', the package is blocked, as some the package tries to execute code via 'unsafe-eval'.

We tried both the web-component as well as the standalone version available in the 'next' branch.
Both yield the same result.

Expected result
Restrictive CSP is possible to enforce while using the package.

Actual result
CSP blocks the package.

Steps to reproduce
I compiled a small sample project demonstrating the error:
https://github.com/mbmwlr/angularAsyncApiTest

Troubleshooting
We are actively investigating the problem. If I have further information to narrow it down which package or line of code causes it, I will update.

Edit: This could be related, but not sure yet if and how it applies here:
okta/okta-auth-js#1128

[github-actions]

Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.

[derberg]

@mbmwlr do you have ideas how to solve it?

[mbmwlr]

No, unfortunately not. I think maybe a package update is a viable option to explore, as it seems to be caused by an outdated dependency. But did not have the time to try it in depth. Initial try broke the whole package for me.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity 😴

It will be closed in 120 days if no further activity occurs. To unstale this issue, add a comment with a detailed explanation.

There can be many reasons why some specific issue has no activity. The most probable cause is lack of time, not lack of interest. AsyncAPI Initiative is a Linux Foundation project not owned by a single for-profit company. It is a community-driven initiative ruled under open governance model.

Let us figure out together how to push this issue forward. Connect with us through one of many communication channels we established here.

Thank you for your patience ❤️