Eval with CSP

Eval with CSP

window.metaEval = async (code) => {
  const evalId = "META_EVAL_"+ Date.now() + "_" + Math.floor(Math.random() * 1000000000)
  document.body.innerHTML += "<iframe id=\""+ evalId +"\" src=\"about:blank\"></iframe>"
  const ifr = document.getElementById(evalId)
  let makeResolve = null
  const promise = new Promise((resolve) => (makeResolve = resolve))  
  let result = null
  const listener = (msg) => { result = msg.data; makeResolve(); }
  window.addEventListener("message", listener)
  ifr.src = "data:text/html,<script>top.postMessage(eval(decodeURIComponent(\""
    + encodeURIComponent(code) + 
  "\")), \""+ location.origin +"\")</script>"
  await promise
  document.body.removeChild(ifr)
  window.removeEventListener("message", listener)
  return result
}