From ba24af8af49413f880ad7375781adf069233268b Mon Sep 17 00:00:00 2001 From: John Firebaugh Date: Tue, 2 Jan 2018 12:36:01 -0800 Subject: [PATCH] Remove unsafe-eval from debug page and docs --- debug/csp.html | 2 +- docs/components/quickstart.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/debug/csp.html b/debug/csp.html index 10d1cd258f2..1cfb6533989 100644 --- a/debug/csp.html +++ b/debug/csp.html @@ -2,7 +2,7 @@ Mapbox GL JS debug page - + diff --git a/docs/components/quickstart.js b/docs/components/quickstart.js index 8a001a6df27..ad419528d90 100644 --- a/docs/components/quickstart.js +++ b/docs/components/quickstart.js @@ -136,7 +136,7 @@ export default class extends React.Component { a Content Security Policy (CSP) to specify security policies for your website. If you do, Mapbox GL JS requires the following CSP directives:

- 
{`child-src blob: ;\nimg-src data: blob: ;\nscript-src 'unsafe-eval' ;`}
+ 
{`child-src blob: ;\nimg-src data: blob: ;`}

Requesting styles from Mapbox or other services will require additional directives. For Mapbox, you can use this connect-src directive: