Remove unsafe-eval CSP Requirement for Blazor WASM

[TanayParikh]

Runtime made the necessary changes that unsafe-eval may no longer be required for Blazor WASM: dotnet/runtime#59416

Note, there's also a Chrome bug which may come into play here (WebAssembly/content-security-policy#7)

This issue tracks validating this fix, and the associated documentation updates.

Original CSP Issue: #34428

[TanayParikh]

Unfortunately this is still an issue due to the Chrome bug:

This resource helps detect if the chrome issue is resolved (WASM related, not blazor specific): https://s3.amazonaws.com/webassembly-chrome-csp/csp_test.html

Others are having the same issue as well: element-hq/element-web#12262

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[mingyaulee]

@TanayParikh based on my testing with dotnet.7.0.0-preview.3.22175.4 the runtime still requires unsafe-eval, mainly due to the evaluation of string in the following line:

https://github.com/dotnet/runtime/blob/14584c60b41ddc361442539f78bc3d54d3ab3ea2/src/mono/wasm/runtime/method-binding.ts#L113

The original issue was closed and locked so I am hoping you might be able to reopen it.

[TanayParikh]

original issue

Can you please provide a link.

[mingyaulee]

I was referring to the issue that you have created and linked to from here.
dotnet/runtime#59416 Make mono CSP Compliant

[danielcor]

Just to show that its not a rare or low-impact issue. This issue is 100% blocking me from using Blazor in new projects. My company has a security requirement on things going into production that disallows us from using unsafe-eval.

[KieranDevvs]

Just to show that its not a rare or low-impact issue.

I second that.

[ctigrisht]

we need this fixed asap, cannot realistically use blazor wasm without this.
EDIT: Is this available as part of .net 8 preview?

[andrewrondeau-optirtc]

I need to point out that this is a very important thing to fix in order for Blazor to be considered mature.

Specifically, "eval()" in Javascript is considered insecure, but Blazor essentially runs via "eval()."

It's quite critical to fix this, in the long-term, for a Blazor-powered site to be considered safe from XSS attacks.