title: "Content Security Policy of your site blocks the use of 'eval' in JavaScript" warning when setting CSP meta tag in Electron
body: <p>I am creating an Electron application, and per the <a href="https://www.electronjs.org/docs/tutorial/security#csp-meta-tag" rel="noreferrer">Electron security tutorial</a> I have added a CSP meta tag. When running the application, this issue appears in devtools.</p>
  <blockquote>
  <p><strong>Content Security Policy of your site blocks the use of 'eval' in JavaScript</strong><br><br>
  The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unauthorized code on your site.<br><br>
  To solve this issue, avoid using <code>eval()</code>, <code>new Function()</code>, <code>setTimeout([string], ...)</code> and <code>setInterval([string], ...)</code> for evaluating strings.</p>
  </blockquote>
  <p>No <code>eval</code> calls or other cases of string evaluation are present in my own code. The issue does not give any clue as to what code is causing it, and my attempts to use the <code>'report-sample'</code> value had no effect on output. The issue does not appear when opening the HTML file in Chrome.</p>
  <p>I can recreate the warning with a very basic application.</p>
  <h3>main.js</h3>
  <pre><code>const path = require(&quot;path&quot;);
  const { app, BrowserWindow } = require(&quot;electron&quot;);
  
  const createWindow = () =&gt; {
    let mainWindow = new BrowserWindow({
      width: 800,
      height: 600,
      webPreferences: {
        contextIsolation: true,
        nodeIntegration: false,
      }
    });
  
    mainWindow.loadURL(`file://${path.join(__dirname, &quot;/index.html&quot;)}`);
  };
  
  app.on(&quot;ready&quot;, createWindow);
  </code></pre>
  <h3>index.html</h3>
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang=&quot;en&quot;&gt;
  &lt;head&gt;
    &lt;meta charset=&quot;UTF-8&quot;&gt;
    &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
    &lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot;default-src 'self'&quot;&gt;
    &lt;title&gt;Document&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
    &lt;h1&gt;CSP Issue Test&lt;/h1&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>I would like to understand why this issue is appearing and resolve it rather than just suppress the warning.</p>