The getOptions function in 1.16.3 contains the following snippet:
if(lang.isArrayLike(valueOrIdx)){
return array.map(valueOrIdx, "return this.getOptions(item);", this); // __SelectOption[]
}
By providing a string for the callback value, the array module then attempts to create a Function from the string. This fails when unsafe-eval is not allowed by the content-security-policy and could be rewritten to pass a function instead of a string e.g.
return array.map(valueOrIdx, (item) => this.getOptions(item), this); // __SelectOption[]
The
getOptionsfunction in 1.16.3 contains the following snippet:By providing a string for the callback value, the array module then attempts to create a Function from the string. This fails when unsafe-eval is not allowed by the content-security-policy and could be rewritten to pass a function instead of a string e.g.