Make the Next.js plugin work with strict CSP settings (#3067)

Co-authored-by: Zack Jackson <[email protected]>

Author: fcano-ut

.changeset/hip-pandas-care.md

@@ -0,0 +1,5 @@
+---
+"@module-federation/nextjs-mf": patch
+---
+
+Make the Next.js plugin work with strict CSP settings

packages/nextjs-mf/src/plugins/container/runtimePlugin.ts

@@ -72,7 +72,12 @@ export default function (): FederationRuntimePlugin {
 
       var moduleCache = args.origin.moduleCache;
       var name = args.origin.name;
-      var gs = new Function('return globalThis')();
+      var gs;
+      try {
+        gs = new Function('return globalThis')();
+      } catch (e) {
+        gs = globalThis; // fallback for browsers without 'unsafe-eval' CSP policy enabled
+      }
       var attachedRemote = gs[name];
       if (attachedRemote) {
         moduleCache.set(name, attachedRemote);