Content Security Policy issues

[stweil]

Describe the bug
The current code (Nextcloud Hub 8 29.0.2) triggers CSP errors "EvalError: call to eval() blocked by CSP".

Each of those errors indicates that some JavaScript code was blocked, that means not processed.

I noticed those errors while I tried to find out why no images were shown for unsigned faces (https://[...]/apps/photos/faces/unassigned), but it looks like CSP errors are throwns on any page which is part of photos.

To Reproduce
Steps to reproduce the behavior:

1. Open https://[...]/apps/photos/ in recent Firefox
2. Activate tools for web developers in Firefox
3. Inspect console in tools for web developers
4. See error

Expected behavior
There should not be any CSP errors.

Desktop (please complete the following information):

• OS: macOS 14.5 (23F79)
• Browser Firefox 126.0

Browser log

EvalError: call to eval() blocked by CSP
    o moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    <anonym> moz-extension://ed062d15-4363-4797-8a7e-d72941f610cd/build/detector.js:1
    inject resource://gre/modules/ExtensionContent.sys.mjs:573
    InterpretGeneratorResume self-hosted:1412
    AsyncFunctionNext self-hosted:799

[joshtrichards]

The moz-extension://UUID suggests me this may be related to one of your active browser extensions.

[stweil]

Thanks! With all extensions disabled, I still get a warning:

Content-Security-Policy: Ignorieren von "blob:" innerhalb script-src-elem: 'strict-dynamic' angegeben

It looks like the Firefox add-on Vue.js devtools raises the error instead of the warning.

[stweil]

Even with all add-ons disabled, I still get (another) error for apps/faces/photos/unassigned (and no photo is shown):

TypeError: e is undefined
    VueJS 22
    fetchUnassignedFaces FetchFacesMixin.js:201
    mounted UnassignedFaces.vue:187
    VueJS 18
    init vue-router.esm.js:3005
    init vue-router.esm.js:3004
    updateRoute vue-router.esm.js:2414
    transitionTo vue-router.esm.js:2263
    confirmTransition vue-router.esm.js:2402
    r vue-router.esm.js:2084
    r vue-router.esm.js:2091
    Yt vue-router.esm.js:2095
    confirmTransition vue-router.esm.js:2396
    r vue-router.esm.js:2084
    r vue-router.esm.js:2088
    m vue-router.esm.js:2384
    u vue-router.esm.js:2127
    Ut vue-router.esm.js:2203
    promise callback*Pt/</< vue-router.esm.js:2150
    jt vue-router.esm.js:2171
    jt vue-router.esm.js:2171
    jt vue-router.esm.js:2170
    Pt vue-router.esm.js:2106
    m vue-router.esm.js:2362
    r vue-router.esm.js:2087

[joshtrichards]

Maybe #2558?