'unsafe-eval' support in Content Security Policy

[Matt]

Hello,

I understand that Kendo UI uses eval calls in its internal template engine.  Are there any plans to develop a workaround that support the rendering of Kendo UI widgets which comply with a strict Content Security Policy that omits the 'unsafe-eval' keyword from the 'script-src'?

Thank you for your time.

[Sourabh]

Hi, appreciate if I can get update related to removal of unsafe-eval in Kendo UI for JQuery controls? Is this in the roadmap if it is not handled at the moment ?

Regards
Sourabh Sahu

[Kiril Nikolov]

Hello Matt,

Currently there is no way for creating templates without the eval() method. Therefore, Kendo UI does not currently support the strict CSP mode.

If CSP mode is enabled for a Kendo UI application, the unsafe-eval keyword should be added as part of the meta tag used for enabling the CSP mode:

<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-eval' 'self' https://kendo.cdn.telerik.com;">

 

Regards,
Kiril Nikolov
Telerik by Progress

 

 

[Matt]

Hello Kiril,

Are there any plans in the future to address this issue with strict CSP?

Thank you

[Kiril Nikolov]

Hi,

It will requires re working the whole template engine and big parts of the framework, and this as big as it sounds. So it is not in our immediate plans.

Regards,
Kiril Nikolov
Telerik by Progress

 

 

[Aleksandr]

Hi,

Would it still be the case with Kendo for Angular (2, 4)?

[Ganesh]

how about kendoreact's recent versions, does it have dependency on unsafe-eval?.

[Neli]

Likewise, to what has been mentioned previously for Kendo UI for Angular suite, the unsafe-eval is not needed in KendoReact.

In case you have additional questions related to the KendoReact suite I would recommend opening a support ticket for the respective product or posting a question in the KendoReact forum:

- https://www.telerik.com/forums/kendo-ui-react

Regards,

Neli

[Dimiter Topalov]

Hi Aleksandr,

This is not the case with Kendo UI for Angular components, as they are "native" Angular components, built entirely using Angular and TypeScript, and rely entirely on the template engine, provided by the Angular framework for rendering.

The Kendo UI Templates, known from the Kendo UI for jQuery were not transferred to Kendo UI for Angular.

Regards,
Dimiter Topalov
Progress Telerik

[Subba]

Hi, Any updates regarding not to use unsafe-eval in Kendo UI for Jquery controls? Is it still in consideration or No at this point of time?

[Ivan Danchev]

Hi Subba,

At present, we have no plans on removing eval, so what's been said earlier in this thread and in this documentation section, is still valid.

Regards,
Ivan Danchev
Progress Telerik

[Sourabh]

Hi, appreciate if I can get update related to removal of unsafe-eval in Kendo UI for JQuery controls? Is this in the roadmap if it is not handled at the moment ?

Regards
Sourabh Sahu

[Neli]

Hi Saurabh, 

The 'unsafe-eval' keyword still should be added as part of the meta tag used for enabling the CSP mode. There is a Feature Request for CSP Support, where the issue is discussed in details. Below you will find a link to it.

- https://feedback.telerik.com/kendo-jquery-ui/1359789-csp-support

Regards,

Neli