Content Security Policy

@Bean
VaadinServiceInitListener cspNonceInjector() {
    return event -> event.addIndexHtmlRequestListener(response -> {
        if (!response.getVaadinRequest().getService()
                .getDeploymentConfiguration().isProductionMode()) {
            return; // Strict CSP works only in production mode
        }
        String nonce = UUID.randomUUID().toString();

        // Make the browser require the nonce for all scripts
        response.getVaadinResponse().setHeader("Content-Security-Policy",
                "script-src 'nonce-" + nonce + "'");

        // Add the nonce to the scripts and module preloads of the page
        Document document = response.getDocument();
        document.select("script, link[rel=modulepreload]")
                .attr("nonce", nonce);
        document.head().appendElement("meta")
                .attr("property", "csp-nonce").attr("nonce", nonce);
    });
}

// Override the Function constructor with a version that uses pre-defined functions
const originalFunction = window.Function;
window.Function = function(...args) {
  const key = args.join(",");

  if (functions.has(key)) {
    return functions.get(key);
  }

  // Calls that load the frontend chunk of a view
  const chunkCall = key.match(/^return window\.Vaadin\.Flow\.loadOnDemand\('([^']*)'\);$/);
  if (chunkCall) {
    const chunk = chunkCall[1];
    return function() { return window.Vaadin.Flow.loadOnDemand(chunk); };
  }

  // Log the code to add to the functions map
  const code = args[args.length - 1];
  console.warn(`functions.set(${JSON.stringify(key)},\n  function(${args.slice(0, -1).join(',')}) {${code}\n});`);

  // Fall back to the original constructor.
  // This fails in strict CSP mode, but this way the browser reports an error.
  return originalFunction.apply(null, args);
};

// Override eval() with a version that uses pre-defined functions
const originalEval = window.eval;
window.eval = function(script) {
  const originalArg = script;
  // Removes parentheses used by Vaadin Charts
  if (script.length > 1 && script.startsWith("(") && script.endsWith(")")) {
    script = script.substring(1, script.length - 1);
  }
  if (evalCalls.has(script)) {
    return evalCalls.get(script);
  }

  // Log the code to add to the evalCalls map
  if (script.startsWith("function")) {
    console.warn(`evalCalls.set(${JSON.stringify(script)},\n  ${script}\n);`);
  } else {
    console.warn(`evalCalls.set(${JSON.stringify(script)},\n  function() {return ${script}\n});`);
  }

  // Fall back to the original eval().
  // This fails in strict CSP mode, but this way the browser reports an error.
  return originalEval(originalArg);
};

const functions = new Map();
functions.set("event,element,return (event.shiftKey)",
  function(event,element) {return (event.shiftKey)});
functions.set("$0,if ($0) window.Vaadin.Flow.gridConnector.initLazy($0)",
  function($0) {if ($0) window.Vaadin.Flow.gridConnector.initLazy($0)});

const evalCalls = new Map();
evalCalls.set("'The value for <b>' + this.x + '</b> is <b>' + this.y + '</b>'",
  function() {return 'The value for <b>' + this.x + '</b> is <b>' + this.y + '</b>'});