Use with a Content Security Policy that prohibits unsafe-eval?

[brianmhunt]

I saw a new Function in the code, so I expect that nunjucks cannot be used without a Content Security Policy that permits unsafe-eval.

As templates are a targeted injection point for malicious code, it would be good if one could use nunjucks while Function/eval are prohibited.

[jlongster]

You definitely can use it with CSP, but you have to precompile your templates. If they are precompiled you just include them like normal JS and nunjucks will use them instead of dynamically creating them: http://mozilla.github.io/nunjucks/api.html#precompiling