On a side note, since both eval() and new Function are restricted by a content security policy in packaged web apps (see here https://developer.chrome.com/extensions/contentSecurityPolicy ), is there a way to avoid using either?