"Invalid JSON string" in Google visualization API example

Question

I am roughly following this example. But must be doing something silly...

The server side Django view code:

data_table = gviz_api.DataTable(description)
data_table.LoadData(data)
json = data_table.ToJSon()
return json

These are the values of the variables copy-pasted from the pydev debugger: (Im using strings for each description field type just for testing)

description:

[("sensor","string", "Sensor name"), 
 ("timestamp","string", "Time"),
 ("value","string", "Sensor value")]

data:

[['testsensor', '2011-05-09 16:06:43.936000', '22.0'],
['testsensor', '2011-05-09 16:56:23.367000', '23.0']]

json (generated by the google api):

{cols:[{id:'sensor',label:'Sensor name',type:'string'},{id:'timestamp',label:'Time',type:'string'},{id:'value',label:'Sensor value',type:'string'}],rows:[{c:[{v:'testsensor'},{v:'2011-05-09 16:06:43.936000'},{v:'22.0'}]},{c:[{v:'testsensor'},{v:'2011-05-09 16:56:23.367000'},{v:'23.0'}]}]}

The client side javascript code that receives the json:

var json_table = new google.visualization.Table(document.getElementById('dataview'));
var json_data = new google.visualization.DataTable(data, 0.6);
json_table.draw(json_data, {showRowNumber: true});

This causes the following error on constructing the DataTable object (second line):

Uncaught Error: Invalid JSON string: {cols:[{id:'sensor',label:'Sensor name',type:'string'},{id:'timestamp',label:'Time',type:'string'},{id:'value',label:'Sensor value',type:'string'}],rows:[{c:[{v:'testsensor'},{v:'2011-05-09 16:06:43.936000'},{v:'22.0'}]},{c:[{v:'testsensor'},{v:'2011-05-09 16:56:23.367000'},{v:'23.0'}]}]}
in default,table.I.js:152

I understood that the whole clue was making sure that the schema format matches the data format but this seems to be the case. It must be something simple.

Answer 1

Make sure you put 'unsafe-eval' for script sources in Content-Security-Policy.

A policy I use for Google Maps and Google Charts:

<meta
  http-equiv="Content-Security-Policy"
  content="
    default-src 'self';
    script-src 'self' 'unsafe-inline' 'unsafe-eval' maps.googleapis.com www.google.com www.google-analytics.com;
    img-src 'self' csi.gstatic.com www.google-analytics.com maps.gstatic.com maps.googleapis.com;
    style-src 'self' 'unsafe-inline' www.google.com fonts.googleapis.com ajax.googleapis.com;
    font-src 'self' fonts.gstatic.com;
  "
/>