Unsafe eval error

[PARKER-X]

I am getting error- Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'strict-dynamic' 'nonce-D7tdvZDbLkjXJesp1m4Ftbme0-jZycnq'".
I am using apache superset 6 version latest

[dosubot[bot]]

This is a Content Security Policy (CSP) issue. Superset 6's default TALISMAN_CONFIG restricts script-src to 'self' + 'strict-dynamic' with per-request nonces, and does not allow 'unsafe-eval' [1]. This blocks any frontend code that relies on eval() or new Function() — commonly triggered by custom JavaScript tooltip generators in deck.gl charts or similar features.

A few things to check:

1. If the CSP is coming from Superset's Talisman (i.e., you have TALISMAN_ENABLED = True), you can relax script-src in your superset_config.py — though this is not recommended for production due to security risks:

   TALISMAN_CONFIG = {
       "content_security_policy": {
           "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
           # keep your other directives (img-src, connect-src, etc.)
       },
       "content_security_policy_nonce_in": ["script-src"],
   }

2. If the CSP is coming from a reverse proxy (e.g., Nginx, Cloudflare, or another layer in front of Superset), you'll need to adjust the Content-Security-Policy header there instead.

3. If you're using custom JS tooltip generators in deck.gl charts, that's the most common cause of this error in Superset 6. The recommended approach is to avoid custom JS and instead shape your data in SQL so that Superset's built-in tooltip renderer can display what you need [2].

Could you share more about what you were doing when the error appeared (e.g., which chart type, any custom JS code)?

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[PARKER-X]

if IS_PRODUCTION:
TALISMAN_ENABLED = True

TALISMAN_CONFIG = {
    "strict_transport_security": True,
    "strict_transport_security_max_age": 31536000,
    "frame_options": None,
    "content_security_policy": {
        "default-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
        "script-src": [
            "'self'",
            "'strict-dynamic'",
            "'unsafe-eval'",  # <-- Add this line
            # Keep any existing configurations like your nonces below
    ],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
}

else:
# Disable Talisman for local dev (it blocks iframes without CSP tuning)
TALISMAN_ENABLED = False
CONTENT_SECURITY_POLICY_WARNING = False
My code

[PARKER-X]

@dosu my code
if IS_PRODUCTION:
TALISMAN_ENABLED = True

TALISMAN_CONFIG = {
    "strict_transport_security": True,
    "strict_transport_security_max_age": 31536000,
    "frame_options": None,
    "content_security_policy": {
        "default-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
        "script-src": [
            "'self'",
            "'strict-dynamic'",
            "'unsafe-eval'",  # <-- Add this line
            # Keep any existing configurations like your nonces below
    ],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
}

else:
# Disable Talisman for local dev (it blocks iframes without CSP tuning)
TALISMAN_ENABLED = False
CONTENT_SECURITY_POLICY_WARNING = False

[dosubot[bot]]

The issue is that 'strict-dynamic' and 'unsafe-eval' are mutually exclusive per the CSP spec. When 'strict-dynamic' is present in script-src, browsers ignore 'unsafe-eval', 'unsafe-inline', and 'self' — so your 'unsafe-eval' is effectively a no-op even though it's listed [1].

You need to pick one approach or the other:

Option A – Keep 'strict-dynamic' (more secure, recommended):
Remove 'unsafe-eval' and rely on nonces. This is the default Superset production config. If you're hitting eval errors, it means some feature you're using (e.g., custom JS tooltips in deck.gl charts) requires eval — you'd need to avoid that feature.

Option B – Drop 'strict-dynamic' and allow eval (less secure):

TALISMAN_CONFIG = {
    "content_security_policy": {
        "default-src": ["'self'"],
        "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
        # ...other directives...
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
}

This is essentially what Superset's built-in TALISMAN_DEV_CONFIG does — it uses 'unsafe-eval' without 'strict-dynamic' [2]. This will fix the eval error but weakens your CSP.

Also worth checking: is a reverse proxy (Nginx, Cloudflare, etc.) injecting its own Content-Security-Policy header? If so, it would override what Talisman sends, and you'd need to fix it there instead.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[PARKER-X]

@dosu not working still

[dosubot[bot]]

Let's debug this step by step. There are a few reasons the error can persist even after changing TALISMAN_CONFIG:

1. Confirm your config file is actually loaded. Check the Superset startup logs for a cyan message like:

Loaded your LOCAL configuration at [/path/to/superset_config.py]

If you don't see this, your config isn't being picked up. Make sure either SUPERSET_CONFIG_PATH is set to the file path, or the file is importable as superset_config on your PYTHONPATH [1].

2. Check the actual HTTP header your browser receives. Open browser DevTools → Network tab → reload the page → click the main document request → look at the Content-Security-Policy response header. This tells you exactly what policy is in effect. If it still shows script-src 'self' 'strict-dynamic' 'nonce-...' without 'unsafe-eval', then either your config isn't loaded or something else is setting the header.

3. A reverse proxy may be overriding the header. If you have Nginx, Cloudflare, or another proxy in front of Superset, it might be injecting its own Content-Security-Policy header, which would override Talisman's [2].

4. Remember: 'strict-dynamic' nullifies 'unsafe-eval'. As mentioned earlier, per the CSP spec, when 'strict-dynamic' is in script-src, browsers ignore 'unsafe-eval'. Your config still has both. Try this instead:

TALISMAN_CONFIG = {
    "strict_transport_security": True,
    "strict_transport_security_max_age": 31536000,
    "frame_options": None,
    "content_security_policy": {
        "default-src": ["'self'"],
        "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
        "style-src": ["'self'", "'unsafe-inline'"],
        "img-src": ["'self'", "data:", "blob:"],
        "connect-src": ["'self'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
}

Note: no 'strict-dynamic' — that's the key difference [3].

5. After changing config, fully restart Superset (not just a reload). Config is read at startup [4].

Could you share what the Content-Security-Policy header looks like in your browser's DevTools? That will tell us exactly where the problem is.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.