[bug] CSP - force usage of 'unsafe-eval' in script-src

[dioup]

bug description:
I implemented some CSP rules in my django app, and it seems that Cap requires 'unsafe-eval' which is not recommended.

affects:

• standalone
• widget (ui)
• widget (wasm solver)
• [] js server
• js solver

to reproduce:
I'm running a django app, with the following CSP configuration:

SECURE_CSP = {
    "default-src": [CSP.SELF],
    "script-src": [
        CSP.SELF,
        CSP.NONCE,
        "'wasm-unsafe-eval'",
    ],
    "connect-src": [
        CSP.SELF,
        CSP.NONCE,
        # "https://cdn.jsdelivr.net/npm/cap-widget",
        "https://cdn.jsdelivr.net/npm/@cap.js/",
        # "https://cdn.jsdelivr.net/npm/bootstrap",
        "https://cap.eurecom.cafe/",
    ],
    "style-src": [
        CSP.SELF,
        CSP.NONCE,
        # "'unsafe-hashes'",
        # "'sha256-MhtPZXr7+LpJUY5qtMutB+qWfQtMaPccfe7QXtCcEYc='",
    ],
    "img-src": [CSP.SELF, "data:"],
    "font-src": [
        CSP.SELF,
        "https://cdn.jsdelivr.net/npm/bootstrap-icons@1.13.1/font/fonts/",
    ],
    "script-src-elem": [CSP.SELF, "'unsafe-inline'", "https://cdn.jsdelivr.net", ],
    "style-src-elem": [
        CSP.SELF,
        CSP.NONCE,
        "https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css",
    ],
    "form-action": [CSP.SELF],
    "frame-src": [CSP.NONE],  # reCAPTCHA iframe
    "frame-ancestors": [CSP.NONE],
    "base-uri": [CSP.SELF],
    "worker-src": [CSP.SELF, "blob:"],
}

The library is successfully loaded from the cdn before hand and this is the implementation:

Observed behaviour

The widget initialises but after the resolution it failed and raise this error

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'nonce-SrehmetsI6K7lPRNfbtDBw' 'wasm-unsafe-eval'” (Missing 'unsafe-eval')

After several run, it seems that the error "moves":

versions and environment:
Linux Mint / Firefox 148.0 (64-bit)/ Cap 1.55

Is it possible to have an implement without allowing "unsafe-eval"?
Best regards

[tiagozip]

we support setting nonces for both css and js, as per our docs!