storybookjs/storybook
View on GitHub[Bug]: CSP - unsafe-eval. SB7 with angular library shows CSP error
Open
#25,225 opened on Dec 14, 2023
addon: a11yangularbughas workaroundhelp wantedsecurity
Repository metrics
- Stars
- (89,909 stars)
- PR merge metrics
- (Avg merge 7d 22h) (184 merged PRs in 30d)
Description
Describe the bug
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".
CSP error appears in story Documentation page when there is more than 1 story. CSP error does not appear in a Documentation page when there is only 1 story. Both examples are in reproduction.
Old issue is here: https://github.com/storybookjs/storybook/issues/24355 This was not fixed properly.
To Reproduce
https://stackblitz.com/edit/github-m6jtth-rjkp49
- Open dev console.
- Go to Button/Documentation page.
- Error appears in console
System
Storybook Environment Info:
System:
OS: Linux 5.0 undefined
CPU: (8) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
Shell: 1.0 - /bin/jsh
Binaries:
Node: 18.18.0 - /usr/local/bin/node
Yarn: 1.22.19 - /usr/local/bin/yarn
npm: 9.4.2 - /usr/local/bin/npm <----- active
pnpm: 8.10.5 - /usr/local/bin/pnpm
npmPackages:
@storybook/addon-a11y: ~7.6.4 => 7.6.4
@storybook/addon-actions: ~7.6.4 => 7.6.4
@storybook/addon-essentials: ~7.6.4 => 7.6.4
@storybook/addon-links: ~7.6.4 => 7.6.4
@storybook/addon-storyshots: ~7.6.4 => 7.6.4
@storybook/angular: ~7.6.4 => 7.6.4
@storybook/testing-library: ~0.2.2 => 0.2.2
@storybook/theming: ~7.6.4 => 7.6.4
eslint-plugin-storybook: ^0.6.15 => 0.6.15
storybook: ~7.6.4 => 7.6.4
Additional context
No response