# No unsafe-eval

- **Pattern:** `ab-001325` (`extension-permissions-security.content-security-policy.no-unsafe-eval`)
- **Severity:** critical
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001325
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001325)

## Why it matters

CWE-95 (Eval Injection) and CWE-79 both apply here: `'unsafe-eval'` in an extension CSP enables `eval()`, `new Function()`, and `setTimeout` with string arguments, all of which can execute attacker-controlled strings as code. In an extension context, that code runs with `chrome.*` API access. OWASP A03 (Injection) covers this attack class. Chrome's own documentation states that `'unsafe-eval'` should never appear in extension CSP; MV3 bans it entirely. Even in MV2, its presence typically indicates AI-generated or copy-pasted code that hasn't been refactored for the privilege model extensions require.

## Severity rationale

Critical because `'unsafe-eval'` allows dynamic string execution in a privileged extension context, enabling any injected string to invoke `chrome.*` APIs directly.

## Remediation

Remove `'unsafe-eval'` from CSP and refactor every `eval()` and `new Function()` call to use static alternatives.

```json
"content_security_policy": {
  "extension_pages": "script-src 'self'; object-src 'none'"
}
```

For template rendering without eval, use `document.createElement` + `.textContent` rather than string-interpolated HTML. If a devtool panel needs to evaluate arbitrary user code, use a sandboxed iframe page — Chrome allows `'unsafe-eval'` in sandboxed pages specifically.

## Detection

- **ID:** `no-unsafe-eval`
- **Severity:** `critical`
- **What to look for:** Quote the `script-src` directive from the CSP. Search for the literal string `'unsafe-eval'` in the policy. Enumerate all source files and for each count occurrences of `eval(`, `new Function(`, and `setTimeout(` with string arguments that indicate eval usage.
- **Pass criteria:** `'unsafe-eval'` is NOT present in the CSP `script-src` directive. No more than 0 occurrences of `eval()` or `new Function()` with string arguments found in the codebase. The extension does not rely on dynamic code execution.
- **Fail criteria:** `'unsafe-eval'` is present in `script-src`, or code uses `eval()` patterns that would require it.
- **Skip (N/A) when:** Never — unsafe-eval is a critical security risk for extensions.
- **Detail on fail:** `"CSP allows 'unsafe-eval', enabling eval() and new Function(). This is a major security risk."`
- **Remediation:** Remove `'unsafe-eval'` from `manifest.json` CSP. Refactor code to avoid eval(). If you need to evaluate user code (e.g., a devtool), use the `chrome.scripting` API or a sandboxed page.

  ```json
  "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'none'" }
  ```

## External references

- cwe CWE-95
- cwe CWE-79
- owasp A03
- external chrome-csp-unsafe-eval — https://developer.chrome.com/docs/extensions/develop/migrate/improve-security#eliminate-usage

Taxons: injection-and-input-trust

HTML version: https://auditbuffet.com/patterns/ab-001325