Kendo elements not working without using unsafe-eval

[Srijita]

I am facing a problem for kendo UI element(Dropdown, MultiSelect, Grid etc. ) in our application where we are implementing Content Security Policy(CSP) in the application. We need to give “unsafe-eval” Value to CSP so that the kendo elements work on the page . But using"unsafe-eval" violates the content security policy. Without the "unsafe-eval" the kendo elements don’t work. Is there any work around if we don’t want to include “unsafe-eval” and all kendo elements should work as expected ?

[Konstantin Dikov]

Hi Srijita,

The template mechanism of Kendo UI uses "eval", which means that the strict CSP mode is not supported. More information on this matter is available in the following help topic:

• https://docs.telerik.com/kendo-ui/troubleshoot/content-security-policy

Best Regards,
Konstantin Dikov
Progress Telerik

[Karina]

Hello, are you planning to remove the unsafe-eval as part of the content security policy?

https://docs.telerik.com/kendo-ui/troubleshoot/content-security-policy

We need to remove this option from our website and we can't due Kendo library.

Thanks,

 

 

[Petar]

Hi Karina,

I've just answered your question in this thread: https://www.telerik.com/forums/kendo-elements-not-working-without-unsafe-eval. 

If you want to discuss something else related to the CSP support, let's continue the communication in the linked above thread. 

Regards,
Petar
Progress Telerik

[Alpi]

Hi Team,

We was using kendo by "unsafe-eval" Content-Security-Policy header. Now we have to remove "unsafe-eval" and "unsafe-inline" from our Content-Security-Policy header because of some security issues. Is there any way to achieve the same functionality without using "unsafe-eval" .

Thanks in advance

[Neli]

Hi Alpi, 

The 'unsafe-eval' is still needed as described in the Content Security Policy article linked below:

- https://docs.telerik.com/kendo-ui/troubleshoot/content-security-policy

As there is a related Feature Request in our official Feedback Portal I would suggest you cast a vote for it:

- https://feedback.telerik.com/kendo-jquery-ui/1359789-csp-support

Regards,

Neli