Refused to evaluate a string as JavaScript because 'unsafe-eval'

[neutcomp]

Hello,

Recently I get this error when filling in something in a textbox in chrome. Does anybody have a glue why and how to solve this.

ExecuteCommand failed!
InError set by the client. Client Error:
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src https: 'unsafe-inline'".

BrowserCommand (Type:'Action',Info:'NotSet',Action:'InvokeJsFunction',Target:'ElementId (tagName: '',occurrenceIndex: '-1')',Data:'document.getElementsByTagName('input')[0].focus()',ClientId:'e0aa945a-25fb-49b3-83a5-e4b7da4f60bb',HasFrames:'False',FramesInfo:'',TargetFrameIndex:'-1',InError:'True',Response:'Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src https: 'unsafe-inline'".
')
InnerException: none.

Thanks
Bjorn

[Nikolay Petrov]

Hello Bjorn,

Would you provide more information on this case please:
 
 - Do you run the product as an administrator?
 - Which is the Chrome version you are using for automation?
 - Which is the product version you are using?
 - Do you get this exception using other browsers?

Kind Regards,
Nikolay Petrov
Progress Telerik

 

[neutcomp]

Sorry I forgot to update the status of the question.

It had to do something with changing the headers in IIS to make it more secure. The webmaster did not notifying us about this change. So he altered it after we found out he had changed something that causes to fail the website/scripts.

So everything works fine now :-)

[Nikolay Petrov]

Hi Bjorn,

Thanks for the update! I appreciate that.

Best Regards,
Nikolay Petrov
Progress Telerik

 

[Sample]

Hello,

 

I am facing below error while executing some payment gateway.

InError set by the client. Client Error:
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://js.stripe.com".

BrowserCommand (Type:'Action',Info:'NotSet',Action:'InvokeJsFunction',Target:'ElementId (tagName: '',occurrenceIndex: '-1')',Data:'((window.top.Telerik && window.top.Telerik.TestStudio && window.top.Telerik.TestStudio.Common && window.top.Telerik.TestStudio.Common.DomProviders && window.top.Telerik.TestStudio.Common.DomProviders.DomProvideFactory && window.top.Telerik.TestStudio.Common.DomProviders.DomProvideFactory.getProvider().getElementByTagNameAndIndex(document, 'div', 50)) || document.getElementsByTagName('div')[50]).focus()',ClientId:'f340c1f8-2288-461c-a764-1ceef3126b1a',HasFrames:'False',FramesInfo:'',TargetFrameIndex:'-1',InError:'True',Response:'Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://js.stripe.com".
')

 

Kindly provide solution.

[Elena]

Hello,

This type of error is caused by a Content Security policy set in a header in the HTTP responses from the tested application server, which does not allow 'unsafe-eval' to be used. However, the Test Studio extension for Chrome uses this function, as well as other, but this particular gets restricted by that security policy. 

Still there are few suggestions you can give a try to: 

Option 1: 
One possible workaround is to discuss the opportunities to have a test environment and build of the application under test, where the CSP imposed by his server is removed. That way you can continue testing the application against Chrome in that test environment. 

Option 2: 
In case the above option is not applicable for some reason, there is a workaround using Fiddler script editor - the idea is to intercept and modify the http traffic. This will require to have Fiddler running during these specific test runs and can affect slightly the performance.
Having these specifics in mind, here is what is necessary: 

- open Fiddler Script Editor
- modify the OnBeforeResponse(oSession: Session) function to perform the following custom script:

if (oSession.oResponse.headers.Exists("Content-security-policy")) {
oSession["ui-backcolor"] = "lime";
oSession["ui-bold"] = "removing CSP";
oSession.oResponse.headers.Remove("Content-security-policy");
}
 
if (oSession.oResponse.headers.Exists("X-Content-security-policy")) {
oSession["ui-backcolor"] = "lime";
oSession["ui-bold"] = "removing CSP";
oSession.oResponse.headers.Remove("X-Content-security-policy");

Then, you can run the recorded test and this will allow Test Studio to execute the required scripts on the page. 

I hope that these notes will be helpful for you. In case you have any further questions, please, let us know.

Regards,
Elena
Progress Telerik