To enhance platform security and give you greater control over your tenant’s Content Security Policy (CSP), BlueConic introduces a setting that governs the use of the unsafe-eval JavaScript expression. The unsafe-eval directive in a CSP allows the use of JavaScript’s eval() function, which can execute arbitrary code. Some custom or legacy plugins depend on this functionality, but it also introduces security risks. Disabling unsafe-eval protects your tenant from script injection and other code execution vulnerabilities.
Note: Your organization might need to disable unsafe-eval to comply with strict security standards. If you rely on plugins or custom scripts that use eval(), enabling unsafe-eval ensures they continue to function while accepting a lower security posture. BlueConic lets you toggle this setting directly in the UI so you can choose between enhanced security and broader plugin compatibility.
Before you begin
Confirm whether your organization requires a stricter security posture that blocks the use of
eval().Make sure your user role includes Security → Edit Security permission. Only these users can modify the unsafe-eval setting. Application Managers can assign this permission from the Roles and Permissions page.
Manage the unsafe-eval setting
In the BlueConic navigation bar, go to Settings.
Navigate to the Security section.
Locate the unsafe-eval setting toggle.
Find the Content Security Policy (CSP) area.
Toggle unsafe-eval:
On: Allows plugins or scripts that use
eval()to run.Off: Blocks the use of
eval()and removeunsafe-evalfrom CSP headers.
The change is applied instantly—navigating to another page immediately reflects the updated policy.