OPSEXP-3507 Add unsafe-eval to default CSP for webapps

[Copilot]

OPSEXP-3507

This PR adds the 'unsafe-eval' directive to the default Content Security Policy (CSP) for webapp locations in the nginx configuration.

Changes Made

Updated the nginx_security_headers_webapps CSP policy in roles/nginx/defaults/main.yml to include 'unsafe-eval' in the script-src directive:

Before:

Content-Security-Policy: "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';"

After:

Content-Security-Policy: "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"

Affected Locations

This change applies to the following webapp endpoints that use the nginx_security_headers_webapps configuration:

• Root location /
• API Explorer /api-explorer/
• Control Center /control-center/
• Workspace /workspace/

Test Updates

Updated the molecule test expectations in roles/nginx/molecule/default/verify.yml for the /workspace/ location to match the new CSP policy with 'unsafe-eval'.

Notes

• The /share/ location already had 'unsafe-eval' configured via nginx_security_headers_share and is unaffected by this change
• The /alfresco/ repository location continues to use nginx_security_headers_repository which has no CSP policy by design
• All changes are minimal and surgical, only adding the required directive where needed

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}