A CSP may restrict usage of `eval()` and similar