CSP prevents advanced rules

[AdamWr]

It's related to this issue - AdguardTeam/AdguardFilters#163515 - the problem is that sponsored posts are not blocked on facebook.com, it happens with Safari extension and app for iOS.
It looks like that script execution is blocked by CSP:

Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy.

I'm aware that's duplicate of #304, there is also similar issue in browser extension repository - AdguardTeam/AdguardBrowserExtension#1733 with a link to possibly fix - AdguardTeam/AdguardBrowserExtension#1733 (comment)

As far as I understand, this is used to execute advanced rules/scripts:

AdGuardForSafari/AdGuard/Extension/advanced-script.js

Lines 14 to 28 in 39ec626

	const executeScripts = scripts => {
	// Wrap with try catch
	scripts.unshift('( function () { try {');
	scripts.push("} catch (ex) { console.error('Error executing AG js: ' + ex); } })();");
	const scriptTag = document.createElement('script');
	scriptTag.setAttribute('type', 'text/javascript');
	scriptTag.textContent = scripts.join('\r\n');
	const parent = document.head || document.documentElement;
	parent.appendChild(scriptTag);
	if (scriptTag.parentNode) {
	scriptTag.parentNode.removeChild(scriptTag);
	}
	};

unfortunately it looks like that this approach is blocked by website's Content Security Policy.
So maybe something like this:

const executeScripts = scripts => {
  // Wrap with try catch 
  scripts.unshift('( function () { try {');
  scripts.push("} catch (ex) { console.error('Error executing AG js: ' + ex); } })();");
  
  const blob = new Blob([scripts.join('\r\n')], {
    type: 'text/javascript'
  });
  const url = URL.createObjectURL(blob);
  const scriptTag = document.createElement('script');
  
  const parent = document.head || document.documentElement;
  parent.appendChild(scriptTag);
  if (scriptTag.parentNode) {
    URL.revokeObjectURL(url);
  }
};

could be used as a workaround, it seems that it works, at least in browser's console while debugging.

[maximtop]

It will help only in the case of facebook, where blobs are not blocked by csp policies.
Seems that it is worth to be added as an additional way.