title: Insecure CSP value "'unsafe-eval'" in directive 'script-src'
body: <p>while trying to load a third-party js file into content scripts in chrome extension. I'm facing an <code>unsafe-eval</code> error</p>
  <p>My <strong>manifest.json</strong> looks like this</p>
  <pre><code>{
      &quot;manifest_version&quot;: 3,
      &quot;name&quot;: &quot;Test&quot;,
      &quot;version&quot;: &quot;1.0&quot;,
      &quot;host_permissions&quot;: [&quot;https://mail.google.com/&quot;],
      &quot;content_scripts&quot;: [
          {
              &quot;matches&quot;: [
                  &quot;https://mail.google.com/*&quot;
              ],
              &quot;js&quot;: [&quot;3rdparty.js&quot;, &quot;code.js&quot;],
              &quot;run_at&quot;: &quot;document_end&quot;
          }
      ]
  }
  </code></pre>
  <p>after loading I'm receiving this error</p>
  <blockquote>
  <p>Error logged: EvalError: Refused to evaluate a string as JavaScript
  because 'unsafe-eval' is not an allowed source of script in the
  following Content Security Policy directive: &quot;script-src 'self'&quot;.</p>
  </blockquote>
  <p>so, I have tried adding csp to the manifest file</p>
  <pre><code>{
  ...,
  &quot;content_security_policy&quot;: {
      &quot;extension_pages&quot;: &quot;script-src 'self' 'unsafe-eval'; object-src 'self'&quot;
    }
  }
  </code></pre>
  <p>then I'm receiving this error in chrome telling that its unable to load the extension</p>
  <blockquote>
  <p>'content_security_policy.extension_pages': Insecure CSP value
  &quot;'unsafe-eval'&quot; in directive 'script-src'.</p>
  </blockquote>