Gutenberg: Unsafe-eval is required?

[Slapbox]

Is your feature request related to a problem? Please describe.
data.min.js:1 Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: ...

Describe the solution you'd like
unsafe-eval should not be required for the block manager

Describe alternatives you've considered
No alternatives

[simison]

I don't see it in the codebase: https://github.com/WordPress/gutenberg/search?q=eval&unscoped_q=eval (apart from E2E tests)

And Eslint is erroring if it would be there:
https://github.com/WordPress/gutenberg/blob/f63053cace3c02e284f00918e1854284c85b9132/packages/eslint-plugin/configs/es5.js#L35

Nor I see it in files in the package: https://unpkg.com/browse/@wordpress/data@4.14.0/

What's the data.min.js file exactly?

[swissspidy]

Is it perhaps a script from a different plugin or a browser extension you use?

[Slapbox]

It definitely seems to be related to Gutenberg, or otherwise some other core function of Wordpress. I don't actually see eval() called anywhere in my poking around so far, but data.min.js is invoked somehow fromblock-editor.min.js.

It's not the result of any browser extension - confirmed by signing in using a Chrome guest session with no extensions. It does not appear to me to be related to any other Wordpress plugin.

It appears to be failing on this line due to, new Function: https://github.com/markjaquith/WordPress/blob/master/wp-includes/js/dist/data.js#L161

So I'm guessing this issue actually should have been opened on the WordPress repo, and not the Gutenberg repo - but can someone here confirm (as silly as it sounds) that I'm correct so I don't go open up another issue wrongly and clutter things up?

[youknowriad]

A code triggered by a Gutenberg script doesn't necessarily mean it's in Gutenberg code base.
The line yo shared is used when creating data stores, it's possible that the error is in a third-party data store.

Also, can you share what browser you're testing in.

We're not able to reproduce this error with Gutenberg only.

[Slapbox]

Thanks for the additional info @youknowriad. I'm seeing the issue in Chrome 79. I'll investigate further when I have some time. For now we've decided to simply allow eval on the backend.

I think you're likely correct in your diagnosis about it being related to a third-party store.