Content Security Policy

String nonce = UUID.randomUUID().toString();

// Add a header to make the browser require the nonce in all script tags
response.getVaadinResponse().setHeader("Content-Security-Policy",
        "script-src 'nonce-" + nonce + "'");

// Add the nonce to all script tags in the host page
response.getDocument().getElementsByTag("script").attr("nonce", nonce);

// Override the Function constructor with a version that uses inlined code if available
const originalFunction = window.Function;
window.Function = function(...args) {
  const key = args.join(",");

  if (functions.has(key)) {
    return functions.get(key);
  }

  if (key.startsWith("return window.Vaadin.Flow.loadOnDemand(")) {
    const chunk = key.split("return window.Vaadin.Flow.loadOnDemand('").pop().split("');").pop();
    return function (chunk) {return window.Vaadin.Flow.loadOnDemand(chunk);};
  }

  // Expression was not found in functions map, and was not chunk-loading call, so log it to console
  const code = args[args.length - 1];
  // Ignore the stats gatherer which isn't used in production mode
  if (code.indexOf("var StatisticsGatherer") == -1) {
    const snippet = `functions.set("${key}",\n  function(${args.slice(0, -1).join(',')}) {${code}});`
    console.warn(snippet);
  }

  // Fall back to the original constructor.
  // This will fail in strict CSP mode, but this way the browser will report an error.
  return originalFunction.apply(null, args)
}

// Override eval(..) with a version that uses inlined code if available
const originalEval = window.eval;
window.eval = function(script) {
  const originalArg = script;
  // Removes parenthesis used by Vaadin Charts
  if (script.length > 1 && script.substring(0, 1) === "(" && script.substring(script.length - 1) === ")") {
    script = script.substring(1, script.length - 1);
  }
  if (evalCalls.has(script)) {
    return evalCalls.get(script);
  } else {
    let snippet = "";
    if (script.startsWith("function")) {
      snippet = `evalCalls.set("${script}",\n  ${script});`
    } else {
      snippet = `evalCalls.set("${script}",\n  function() {return ${script}});`
    }
    console.warn(snippet);

    // Fall back to the original eval.
    // This will fail in strict CSP mode, but this way the browser will report an error.
    originalEval.apply(null, originalArg);
  }
}

const evalCalls = new Map();
evalCalls.set("'The value for <b>' + this.x + '</b> is <b>' + this.y + '</b>'",
    function() {return 'The value for <b>' + this.x + '</b> is <b>' + this.y + '</b>'});

const functions = new Map();
functions.set("$0,$1,return $0.$connector.confirm($1)",
    function($0,$1) {return $0.$connector.confirm($1)});