> you should arguably disable eval [using CSP] to help prevent code injections Depending on CSP is a smell, just like any time you open a GUI program from the

> you should arguably disable eval [using CSP] to help prevent code injections Depending on CSP is a smell, just like any time you open a GUI program from the terminal and it spams a bunch of (clearly undesirable) stuff to stdout—or, for that matter, opening the browser console on a given Web page and seeing a bunch of exceptions or other kinds of printf-style debugging spew that shouldn't have gotten checked in. Besides that, using CSP to disable injected content is user-hostile, which is annoying given that the only "justification" for CSP only comes down to Web publishers whose development practices are such a mess that they don't have control over their content (which, due to the normalization of deviance in the world of Web development, means most of them these days). Nowadays, I open up the browser console on pages associated with big name properties (Google, GitHub...), and it's filled with CSP and CORS violations that never should have escaped into production. I think it was better when browsers had status bars and IE put a badge in the corner, e.g. indicating when the current page encountered an error during the execution of a script. It forced publishers to confront the shoddiness of their work and deal with it if for no other reason than out of sheer embarrassment. > button in forms submit the form by default. If you don't want that behavior add type="button". No need for event.preventDefault() That, too, would be user-hostile. Keep your markup semantic so agents can reason about the content on a page. Don't just target incidental behavior.