allow calls to new Function(); - but not to the actual constructed function. under csp unsafe-eval.

[graingert]

This will allow introspecting language support, eg ES2015 etc.

eg:

function isConstSupported() {
  try {
    new Function('const foo = 3');
    return true;
  catch (e) {
    return false;
  }
}

[fcano-ut]

I'm not sure if this represent's the same issue I'm having, but I noticed a very annoying behavior. The CSP report-to endpoint is being triggered as if we had a CSP error, although the code is inside a try/catch block.

For example, this code is causing report: try{new Function('return import("")'),window.rudderAnalyticsBuildType="modern"}catch(l){}

Bundlers like webpack use these kind of techniques extensively, so this means we have at least one error being reported for every bundle we load on every page.

This generates a lot of noise. Chrome and Safari are smart enough to not show those errors on the console, but they still send a report. Firefox surfaces those errors on the console.

The issue I have with this behavior is that it makes it impossible to filter out "real" errors from my reports. If I ever introduce a call to new Function that is not try/catch'd in code, I would expect a CSP report to get triggered. But with so much noise in my logs, it would be impossible to know when that happens because there are so many false positives.

I was not able to find a way to filter out "fake" errors from "real" errors.

I think this is related to your issue, but I'm not entirely sure if they're the same issue. hope it's not out of place here.