javascript-我可以在同一个 script-scr 中同时使用 'unsafe-inline' 和 'unsafe-eval' 还是需要添加一个新的 script-scr？

我正在与盖茨比插件csp并且想了解是否可以在同一脚本scr中添加两个关键字“unsafe inline”和“unsafe eval”，并使其正常工作？还是需要创建两个不同的脚本scr？我必须使用一些源代码，其中一些需要eval（）和其他内联脚本。

我可以这样做吗？

// In your gatsby-config.js
module.exports = {
  plugins: [
    {
      resolve: `gatsby-plugin-csp`,
      options: {
        disableOnDev: true,
        reportOnly: false, // Changes header to Content-Security-Policy-Report-Only for csp testing purposes
        mergeScriptHashes: true, // you can disable scripts sha256 hashes
        mergeStyleHashes: true, // you can disable styles sha256 hashes
        mergeDefaultDirectives: true,
        directives: {
          "script-src": "'self' 'unsafe-inline' 'unsafe-eval' www.example.com",
          "style-src": "'self' 'unsafe-inline'",
          "img-src": "'self' data: www.google-analytics.com"
          // you can add your directives or override defaults
        }
      }
    }
  ]
};

还是我应该这样做？

// In your gatsby-config.js
module.exports = {
  plugins: [
    {
      resolve: `gatsby-plugin-csp`,
      options: {
        disableOnDev: true,
        reportOnly: false, // Changes header to Content-Security-Policy-Report-Only for csp testing purposes
        mergeScriptHashes: true, // you can disable scripts sha256 hashes
        mergeStyleHashes: true, // you can disable styles sha256 hashes
        mergeDefaultDirectives: true,
        directives: {
          "script-src": "'self' 'unsafe-inline' www.example.com",
          "script-src": "'self' 'unsafe-eval' www.example.com",
          "style-src": "'self' 'unsafe-inline'",
          "img-src": "'self' data: www.google-analytics.com"
          // you can add your directives or override defaults
        }
      }
    }
  ]
};

我已经尝试将第一个选项与“unsafe inline”和“unsafe eval”一起使用，在这种情况下，其中一半会出现如下错误Refused to load the script 'http://embed.example.com/next/embed.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval'

我也得到了这个错误Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com https://www.googletagmanager.com

当我更改关键字的顺序，将“unsafe eval”和“unsafe inline”放在一起时，仍然会出现拒绝运行其他脚本的错误。