The following line is currently required in order for the JSON validator to function:
"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",

Options:

• Try to run the validator in a sandboxed iframe. Check this out:
  https://developer.chrome.com/extensions/sandboxingEval
• Find a validator that doesn't have that problem. Both djv and ajv required unsafe-eval. Not too many good options. Try z-schema?