CSP failing on new Function causing 'default-src unsafe-eval'

[torbenvanassche]

The context of where the error occurs I am not exactly sure about, but enabling a CSP requires unsafe-eval for draco-compression (and basis compressing for textures also has the same issue).

Is there a workaround for this so I can enable the CSP without allowing unsafe-eval?

[sawa-zen]

We're also hitting this in XRift, a WebXR social VR platform built with Three.js and @react-three/drei. The Draco decoder loaded via three-stdlib → draco3d uses Emscripten's embind, which calls new Function() inside craftInvokerFunction. This forces us to allow 'unsafe-eval' in our CSP script-src directive, which we'd like to avoid.

The root cause is that the draco WASM binaries are built with Emscripten's default DYNAMIC_EXECUTION=1. Building with -sDYNAMIC_EXECUTION=0 would eliminate the new Function() calls and allow sites to use the stricter 'wasm-unsafe-eval' directive instead.

Stack trace for reference:

EvalError: Evaluating a string as JavaScript violates the following
Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' blob:"

    at Function (<anonymous>)
    at newFunc (...)
    at craftInvokerFunction (...)
    at __embind_register_function (...)

Would the team consider rebuilding with -sDYNAMIC_EXECUTION=0? We understand there may be performance implications (emscripten-core/emscripten#20673), but for a mesh decoder the impact should be minimal since the hot path is in WASM, not in the JS invoker glue.