Issue in telemetry.min.js when CSP enabled

[dbsheta]

We have a security requirement due to which we need to add CSP headers in our app. Following the the nginx configuration we are using for the same:

add_header Content-Security-Policy "default-src 'self'  ${URL} script-src 'self' 'nonce-$request_id'; object-src 'self'; img-src 'self' blob: data:; font-src 'self'; media-src 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';"

After adding this, we are getting unsafe-eval exception in the browser.

The error is because some code in telemetry.min.js is using eval, which is not recommended from security perspective.

We are looking for an efficient solution for this, but a quick fix would also be really helpful.

[404shades]

This is a real concern from security perspective eval function calls should not be allowed as this can make our app more prone to security attacks. Thanks @dbsheta for bringing this into notice.
@manjudr, Can these eval function calls be removed from telemetry.min.js file? Kindly look into this and address what could be the possible solution for this.
Thanks