# Theme component invalid “extend content security policy” value

**URL:** <https://meta.discourse.org/t/theme-component-invalid-extend-content-security-policy-value/350861>\
**Category:** Bug\
**Created:** [February 6, 2025, 12:26pm UTC](https://meta.discourse.org/t/theme-component-invalid-extend-content-security-policy-value/350861 "2025-02-06T12:26:27Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)\
**Post date:** [February 6, 2025, 12:26pm UTC](https://meta.discourse.org/t/theme-component-invalid-extend-content-security-policy-value/350861/1 "2025-02-06T12:26:27Z")

</div>

Symptoms: after update to 3.4 the entire forum gave “Oops”. To make things worse, the logs stayed completely silent about this.

There was a theme component with “extend security policy” with value `script-src: 'unsafe-eval' https://redacted.example.com`

This crashed the entire forum because of an exception thrown in the action dispatcher, because there was a space in the value.

```plaintext
ActionDispatch::ContentSecurityPolicy::InvalidDirectiveError (Invalid Content Security Policy script-src: \"'unsafe-eval' https://redacted.example.com\". Directive values must not contain whitespace
 or semicolons. Please use multiple arguments or other directive methods instead.)

```

Oh I forgot the most important thing. [Safe mode](https://meta.discourse.org/t/53504?silent=true) did not work!!

---

_[View the full topic](https://meta.discourse.org/t/theme-component-invalid-extend-content-security-policy-value/350861)._