I have a big legacy web app that needs to be made CSP (content security policy) compliant. It is full of inline event handlers, eg

onclick=”alert(‘hello’)”

I am trying to write some js which will scan the page on load and replace all these inline handlers with dynamically assigned handlers, eg

var oc = $(“#btn”).attr(“onclick”);

$(“#btn”).on(“click”, function(){oc});

This obviously wont work, I don’t know what each inline event is ahead of time, so it needs to be added as a string. Trouble is there is no way of doing this I can find which is CSP compliant. I tried using

var func = Function(oc);
btn.on(“click”, func);

but CSP caught this as “unsafe eval”. I tried discovering how angular does it, as in how it converts ng-click to real onclick events but it seems to extreme low level custom compiling or some such. Does any one have any ideas as to how I may achieve this?

Thanks!