Strict CSP: 'unsafe-eval' is no longer required Fixed
Until 2.7.1 the editor required script-src 'unsafe-eval'. Without it new RichTextEditor()threw, so a strict policy did not degrade the editor — it stopped it being built at all.
The failure was disguised, which is why it went unnoticed. When the constructor threw, the container was still in the DOM, the toolbar still had its full complement of buttons, and the side panels still rendered. A visual check passed. Only wrapping the constructor in try/catch, or picking the single script-src refusal out of the style noise in the console, showed that the editor had never finished constructing.
The cause was ours and small: a licensing warning built console.warn(...)as a string and passed it to the dynamic-code global, so that the string would not appear in the obfuscated build. It is a direct call now. The concealment turned out to cost nothing to give up — the obfuscated output does not contain the string either way.
Measured against this build, with the editor and its plugins served from the same origin:
script-src 'self'withstyle-src 'self'— editor builds, 12 refusals, all of them stylesheets the editor injects at runtime.script-src 'self'withstyle-src 'self' 'unsafe-inline'— editor builds, zero refusals.
The remaining 12 refusals under style-src 'self' are stylesheets the editor injects at runtime; they are noisy rather than harmful, and removing them is separate work. The CSP article has the full matrix and the policy we recommend.
If you added 'unsafe-eval' for us, you can take it out. Nothing else in the release requires it.