title: Chrome app content security policy not leting to run eval() even after made changes in manifest.json
body: <p>I'm developing a Chrome App with <strong>Google Blockly</strong>. In order to run JavaScript code dynamically I want to use <code>eval()</code> function.</p>
  <hr />
  <p><a href="https://developer.chrome.com/extensions/contentSecurityPolicy#relaxing-eval" rel="nofollow noreferrer">Chrome app relaxing the default policy using manifest</a></p>
  <p>I tried the above link. I used this manifest as suggested by chrome docs.</p>
  <hr />
  <h2>manifest.json</h2>
  <pre><code>{
    &quot;manifest_version&quot;: 2,
    &quot;name&quot;: &quot;Blockly&quot;,
    &quot;version&quot;: &quot;1.0.0&quot;,
    &quot;icons&quot;: {
      &quot;128&quot;: &quot;icon_128.png&quot;
    },
    &quot;permissions&quot;: [],
    &quot;app&quot;: {
      &quot;background&quot;: {
        &quot;scripts&quot;: [&quot;background.js&quot;]
      }
    },
    &quot;minimum_chrome_version&quot;: &quot;46&quot;,
    &quot;content_security_policy&quot;: &quot;script-src 'self' 'unsafe-eval'; object-src 'self'&quot;
  }
  </code></pre>
  <hr />
  <h2>inject.js</h2>
  <pre><code>window.addEventListener(&quot;load&quot;, function() {
   document.getElementById(&quot;myBtn&quot;).addEventListener(&quot;click&quot;, function() {
    let code = 'initiate();';
    try {
      eval(code);
     } catch (e) {
       console.log(e); 
    }
   });
  });
  </code></pre>
  <hr />
  <p>I am still getting this error :</p>
  <blockquote>
  <p>EvalError: Refused to evaluate a string as JavaScript because
  'unsafe-eval' is not an allowed source of script in the following
  Content Security Policy directive: &quot;script-src 'self' blob:
  filesystem: 'wasm-eval'&quot;.</p>
  <p>at HTMLButtonElement. (inject.js:40)</p>
  </blockquote>