storybookjs/storybook

[Bug]: CSP - unsafe-eval. SB7 with angular library shows CSP error

Open

#25,225 opened on Dec 14, 2023

View on GitHub
 (4 comments) (0 reactions) (0 assignees)TypeScript (10,058 forks)batch import
addon: a11yangularbughas workaroundhelp wantedsecurity

Repository metrics

Stars
 (89,909 stars)
PR merge metrics
 (Avg merge 7d 22h) (184 merged PRs in 30d)

Description

Describe the bug

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".

CSP error appears in story Documentation page when there is more than 1 story. CSP error does not appear in a Documentation page when there is only 1 story. Both examples are in reproduction.

Old issue is here: https://github.com/storybookjs/storybook/issues/24355 This was not fixed properly.

To Reproduce

https://stackblitz.com/edit/github-m6jtth-rjkp49

  1. Open dev console.
  2. Go to Button/Documentation page.
  3. Error appears in console

System

Storybook Environment Info:

  System:
    OS: Linux 5.0 undefined
    CPU: (8) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Shell: 1.0 - /bin/jsh
  Binaries:
    Node: 18.18.0 - /usr/local/bin/node
    Yarn: 1.22.19 - /usr/local/bin/yarn
    npm: 9.4.2 - /usr/local/bin/npm <----- active
    pnpm: 8.10.5 - /usr/local/bin/pnpm
  npmPackages:
    @storybook/addon-a11y: ~7.6.4 => 7.6.4 
    @storybook/addon-actions: ~7.6.4 => 7.6.4 
    @storybook/addon-essentials: ~7.6.4 => 7.6.4 
    @storybook/addon-links: ~7.6.4 => 7.6.4 
    @storybook/addon-storyshots: ~7.6.4 => 7.6.4 
    @storybook/angular: ~7.6.4 => 7.6.4 
    @storybook/testing-library: ~0.2.2 => 0.2.2 
    @storybook/theming: ~7.6.4 => 7.6.4 
    eslint-plugin-storybook: ^0.6.15 => 0.6.15 
    storybook: ~7.6.4 => 7.6.4

Additional context

No response

Contributor guide