>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3440095. --> Reported by: [sunlix](https://www.drupal.org/user/1515828) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>CKEditor Abbreviation use <code>eval</code> in its webpack build to execute the plugin.<br> I am running all sites with a strict Content Security Policy and try to avoid <code>unsafe-inline</code> and <code>unsafe-eval</code> policies.</p> <p>There are several lines like this:</p> <pre>eval('__webpack_require__.r(__webpack_exports__);\n/* harmony export */ __webpack_require__.d(__webpack_exports__, {\n/* harmony export */&nbsp;&nbsp; "default": () =&gt; (/* binding */ Abbreviation)\n/* harmony export */ });\n/* harmony import */ var ckeditor5_src_core__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ckeditor5/src/core */ "ckeditor5/src/core.js");\n/* harmony import */ var _abbreviationediting__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ./abbreviationediting */ "./js/ckeditor5_plugins/abbreviation/src/abbreviationediting.js");\n/* harmony import */ var _abbreviationui__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! ./abbreviationui */ "./js/ckeditor5_plugins/abbreviation/src/abbreviationui.js");\n\n\n\n\nclass Abbreviation extends ckeditor5_src_core__WEBPACK_IMPORTED_MODULE_0__.Plugin {\n\tstatic get requires() {\n\t\treturn [ _abbreviationediting__WEBPACK_IMPORTED_MODULE_1__["default"], _abbreviationui__WEBPACK_IMPORTED_MODULE_2__["default"] ];\n\t}\n}\n\n//# sourceURL=webpack://CKEditor5.abbreviation/./js/ckeditor5_plugins/abbreviation/src/abbreviation.js?')</pre><h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Download and enable drupal.org/project/csp (<code>script-src</code>)</li> <li>Download and enable CKEditor Abbreviation</li> <li>Try to add a node and watch the browser is blocking the execution of the hole CKEditor</li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Do a javascript build without <code>eval</code> usage.</p>