Merge pull request #8722 from backstage/rugvip/csp

backend-common: reintroduce unsafe-eval

.changeset/plenty-lobsters-grow.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Reverted the default CSP configuration to include `'unsafe-eval'` again, which was mistakenly removed in the previous version.

packages/backend-common/src/service/lib/ServiceBuilderImpl.ts

@@ -228,6 +228,10 @@ export function applyCspDirectives(
   const result: ContentSecurityPolicyOptions['directives'] =
     helmet.contentSecurityPolicy.getDefaultDirectives();
 
+  // TODO(Rugvip): We currently use non-precompiled AJV for validation in the frontend, which uses eval.
+  //               It should be replaced by any other solution that doesn't require unsafe-eval.
+  result['script-src'] = ["'self'", "'unsafe-eval'"];
+
   if (directives) {
     for (const [key, value] of Object.entries(directives)) {
       if (value === false) {