Axe-core script fails under strict content security policy which disallows unsafe eval() executions. The source of the violations is stemming from the doT library and is documented here: olado/doT#276.
The issues can be attributed to two specific areas:
axe.imports['doT'] = function(module, exports, define, require, process) {
var global = Function('return this')();
... ...
_globals = function() {
return this || (0, eval)('this');
}();
...Mitigating these two areas of the script seems to resolve the issue as demoed under the fixed link below. It seems that this package (doT) is no longer under active development, and the owners do not care for addressing the security violations. It would be advisable to avoid this package altogether, if possible.
Axe-core script fails under strict content security policy which disallows unsafe eval() executions. The source of the violations is stemming from the doT library and is documented here: olado/doT#276.
The issues can be attributed to two specific areas:
... _globals = function() { return this || (0, eval)('this'); }(); ...Mitigating these two areas of the script seems to resolve the issue as demoed under the fixed link below. It seems that this package (doT) is no longer under active development, and the owners do not care for addressing the security violations. It would be advisable to avoid this package altogether, if possible.