Relaxed content security policy

[lsrepo]

A line in the manifest file may pose security issue due to relaxed content security policy.

chrome-extension-webpack-boilerplate/src/manifest.json

Line 15 in d764ce1

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

However, we strongly recommend against doing this. These functions are notorious XSS attack vectors.

CSP discussed in Chrome Developer Documentation

I understand it is done to allow the eval script to be run in webpack dev server. But this should be removed in the production build. One way to do it is adding some reduction here:

chrome-extension-webpack-boilerplate/webpack.config.js

Line 61 in d764ce1

transform: function (content, path) {

[WofWca]

Changing source mapping method worked for me, with no need to change CSP:

module.exports = {
  devtool: process.env.NODE_ENV === 'production'
    ? 'source-map'
    : 'inline-source-map',

  ...
}