google-protobuf struct_pb.js use unsafe-eval conflict with CSP

[BichengWang]

Version: google-protobuf: 3.10.0
Language: Javascript
Operating system (Linux ...)

When using struct.proto's js file: struct_pb.js as a class to build Struct, the production environment give out error message as follows:

{"message":"Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"script-src 'self' 'unsafe-inline' https://d1a3f4spazzrp4.cloudfront.net https://d3i4yxtzktqr9n.cloudfront.net 'nonce-669066d6-d3d1-4736-a703-681c7d493d4a' https://www.google-analytics.com https://ssl.google-analytics.com maps.googleapis.com maps.google.com\".\n","source":"https:///***/client-vendor-cc1de10a77a3962aec6b.js","line":100,"col":145935,"error":{"stack":"Function at /home/***/node_modules/google-protobuf/google/protobuf/struct_pb.js:13:13\n ......   

The struct_pb.js file line 13:

var jspb = require('google-protobuf');
var goog = jspb;
var global = Function('return this')();

goog.exportSymbol('proto.google.protobuf.ListValue', null, global);
goog.exportSymbol('proto.google.protobuf.NullValue', null, global);
goog.exportSymbol('proto.google.protobuf.Struct', null, global);
goog.exportSymbol('proto.google.protobuf.Value', null, global);
goog.exportSymbol('proto.google.protobuf.Value.KindCase', null, global);

That's an unsafe_eval and cannot pass Content Security Policy-restricted environments.

[rhanesoghlyan]

I have the same problem

[dlj-NaN]

Even though this issue is older (and has more thumbsups!), I'm going to call it a duplicate of protocolbuffers/protobuf-javascript#25. The newer issue has a bit more context, so I think it may be a better point for collecting further discussion.

Please feel free to follow up there, and thanks for filing this issue!