From 341356f100f56c502de0111da14b1cfbeb65c162 Mon Sep 17 00:00:00 2001
From: Andrei Vorobev <738482+vorobey@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:41:02 +0300
Subject: [PATCH] ASPNet: template compiler csp onetime detection

---
 packages/devextreme/js/aspnet.js | 43 +++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/packages/devextreme/js/aspnet.js b/packages/devextreme/js/aspnet.js
index da464425f726..d6375132c90d 100644
--- a/packages/devextreme/js/aspnet.js
+++ b/packages/devextreme/js/aspnet.js
@@ -31,6 +31,21 @@
 })(function($, setTemplateEngine, templateRendered, Guid, validationEngine, iteratorUtils, extractTemplateMarkup, encodeHtml, ajax) {
     var templateCompiler = createTemplateCompiler();
     var pendingCreateComponentRoutines = [ ];
+    var isFunctionConstructorAllowed;
+
+    function canUseFunctionConstructor() {
+        if(isFunctionConstructorAllowed === undefined) {
+            try {
+                // eslint-disable-next-line no-new-func
+                new Function('return true');
+                isFunctionConstructorAllowed = true;
+            } catch(e) {
+                // Content Security Policy without 'unsafe-eval' blocks the Function constructor.
+                isFunctionConstructorAllowed = false;
+            }
+        }
+        return isFunctionConstructorAllowed;
+    }
 
     function createTemplateCompiler() {
         var ENCODE_QUALIFIER = '-',
@@ -85,20 +100,24 @@
             bag.push('}', 'return _.join(\'\')');
             var code = bag.join('');
 
-            try {
-                // eslint-disable-next-line no-new-func
-                return new Function('obj', 'encodeHtml', code);
-            } catch(e) {
-                var src = element[0];
-                if(src.tagName === 'SCRIPT') {
-                    var funcName = src.id.replaceAll('-', '');
-                    var func = 'function ' + funcName + '(obj,encodeHtml){\n' + code + '\n}';
-                    $.globalEval(func, src, window.document);
-                    return funcName;
-                } else {
-                    return text;
+            if(canUseFunctionConstructor()) {
+                try {
+                    // eslint-disable-next-line no-new-func
+                    return new Function('obj', 'encodeHtml', code);
+                } catch(e) {
+                    // Fall through to the script-based path on template syntax errors.
                 }
             }
+
+            var src = element[0];
+            if(src.tagName === 'SCRIPT') {
+                var funcName = src.id.replaceAll('-', '');
+                var func = 'function ' + funcName + '(obj,encodeHtml){\n' + code + '\n}';
+                $.globalEval(func, src, window.document);
+                return funcName;
+            } else {
+                return text;
+            }
         };
     }