csp unsafe eval

as a workaround I use a post-install-cmd:
"sed -i 's|new Function(\"opts\",e)|()=>console.error('\"'\"'not available with csp'\"'\"')|g' web/libraries/klaro/dist/klaro-no-translations-no-css.js"

Seems like the "bad code" is an edge case anyway. I didn't need it so far.

The drupal module also uses a Function Constructor. I made a patch which replaces it with inline javascript. It uses JSON.stringify thus it won't work if you need none static properties from the service object.

https://git.drupalcode.org/project/klaro/-/merge_requests/91.patch

jan kellermann → made their first commit to this issue’s fork.