EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script

[sgerace]

In production, it is good practice to use something like helmet to apply standard best-practice security headers. When applied to our Docusaurus site running docusaurus-lunr-search, we receive the following error when the site loads:

2544.3be5f571.js:2 Uncaught (in promise) EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-pBkmluod9Ko4GzDfbWgKM/wxzujFXUdGVOePkwOQT+c='".

    at new Function (<anonymous>)
    at e.makeTemplate (2544.3be5f571.js:2:49486)
    at e.generate (2544.3be5f571.js:2:49295)
    at e.compile (2544.3be5f571.js:2:51037)
    at g.getSuggestionTemplate (2544.3be5f571.js:2:89980)
    at new g (2544.3be5f571.js:2:87147)
    at main.bd71234b.js:2:250015
    at main.bd71234b.js:2:250503

Notice that we have already added a hash for the inline scripts that are added by Docusaurus itself (see facebook/docusaurus#10231). I've confirmed that this is caused by docusaurus-lunr-search as removing the search plugin from our site causes the error to go away. This has also been mentioned in similar issues (see #156 (comment))

Adding 'unsafe-eval' to our CSP allows the search bar to work properly, however, we would prefer if this was not needed as this reduces the protection against certain types of DOM-based XSS bugs.