{"action":"created","issue":{"url":"https://api.github.com/repos/angular/angular.js/issues/11465","labels_url":"https://api.github.com/repos/angular/angular.js/issues/11465/labels{/name}","comments_url":"https://api.github.com/repos/angular/angular.js/issues/11465/comments","events_url":"https://api.github.com/repos/angular/angular.js/issues/11465/events","html_url":"https://github.com/angular/angular.js/issues/11465","id":65276891,"number":11465,"title":"ngCsp example doesn't work","user":{"login":"ottens","id":4661657,"avatar_url":"https://avatars.githubusercontent.com/u/4661657?v=3","gravatar_id":"","url":"https://api.github.com/users/ottens","html_url":"https://github.com/ottens","followers_url":"https://api.github.com/users/ottens/followers","following_url":"https://api.github.com/users/ottens/following{/other_user}","gists_url":"https://api.github.com/users/ottens/gists{/gist_id}","starred_url":"https://api.github.com/users/ottens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ottens/subscriptions","organizations_url":"https://api.github.com/users/ottens/orgs","repos_url":"https://api.github.com/users/ottens/repos","events_url":"https://api.github.com/users/ottens/events{/privacy}","received_events_url":"https://api.github.com/users/ottens/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-03-30T18:51:04Z","updated_at":"2015-03-30T22:07:57Z","closed_at":null,"body":"Hi,\r\n\r\nI'm looking into ngCsp to secure an app I'm working on, but could not get it to reject anything that was supposedly bad. So I went back to the example in the documentation, but that one seemingly doesn't work either. The eval in the example evaluates nicely instead of throwing an error. This goes for 1.4, 1.3 and 1.2.28 on my local setup. Am I missing something obvious? Tried latest chrome, firefox and safari on yosemite mac.\r\n\r\nTry and click the evil button in the example. I'm getting no response and can log the eval outcome. \r\n\r\nhttps://docs.angularjs.org/api/ng/directive/ngCsp\r\n\r\nThanks,\r\nMaarten"},"comment":{"url":"https://api.github.com/repos/angular/angular.js/issues/comments/87850347","html_url":"https://github.com/angular/angular.js/issues/11465#issuecomment-87850347","issue_url":"https://api.github.com/repos/angular/angular.js/issues/11465","id":87850347,"user":{"login":"Expyron","id":5100376,"avatar_url":"https://avatars.githubusercontent.com/u/5100376?v=3","gravatar_id":"","url":"https://api.github.com/users/Expyron","html_url":"https://github.com/Expyron","followers_url":"https://api.github.com/users/Expyron/followers","following_url":"https://api.github.com/users/Expyron/following{/other_user}","gists_url":"https://api.github.com/users/Expyron/gists{/gist_id}","starred_url":"https://api.github.com/users/Expyron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Expyron/subscriptions","organizations_url":"https://api.github.com/users/Expyron/orgs","repos_url":"https://api.github.com/users/Expyron/repos","events_url":"https://api.github.com/users/Expyron/events{/privacy}","received_events_url":"https://api.github.com/users/Expyron/received_events","type":"User","site_admin":false},"created_at":"2015-03-30T22:07:57Z","updated_at":"2015-03-30T22:07:57Z","body":"Hi ottens,\r\n\r\nMy understanding is that the *ngCsp* directive will prevent angular from using features forbidden by CSP (e.g. *eval*), in its internals. However, angular will not prevent you from using these features in your own code. If anything is forbidden, it will be at the browser level and not by angular.\r\n\r\nAs for the example, CSP isn't enabled on usual webpages, so the browser doesn't throw an error when *eval* is used. I do agree that the example is not optimal since CSP is not enabled, and thus nothing happens when you press the Evil button.\r\n\r\nThe same thing happens with your app. CSP is not enabled in the environment you are testing in. I don't know what your environment is, but if everything is allowed in it, you don't have to worry about CSP at all."}}