Option to not use eval/Function for use in a CSP environment without unsafe-eval

[segevfiner]

Using fast-redact is currently not possible with a CSP without unsafe-eval in the browser, an option to not use eval/Function at the cost of worse performance will be helpful for such environments.

[jsumners]

Utilizing Function is core to the design of this module. You're going to want to use a different redator.

[segevfiner]

Any recommendations for something similar?

[jsumners]

I do not know of anything. Research would need to be done.

[segevfiner]

Hmmm. An idea, we can have an option to inject a script tag into the dom instead of using eval when in the browser. Which can be allowed under a CSP using a nonce that we will need to receive and include with the tag as well.