I have previously been using ChartJS to generate a dashboard in a custom community using Lightning Components. It appears that the Spring 17 release does not like the ChartJS library. I get 2 separate errors, one for each chart I'm generating.

For a bar chart I'm using, I get a "str.replace is not a function" when trying to generate the chart.

For a Pie chart I'm using, I get a popup error in builder when I try to generate the legend: 'Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src *".'

So, 2 questions: 1. Is anyone else seeing this? 2. What alternative JS libraries are you using for custom charts in communities?

  • Have you experienced any issues with ChartJS components breaking between page changes? I have the same component on two different pages. They both work fine when I refresh to load each page. But when I click a community navigation link and the page uses the single-page-app version of navigation, all the ChartJS components will break. Any ideas what this is or how to fix it?
    – Isaac
    Sep 2, 2017 at 4:24
  • I should add that no JS errors appear in the console from Aura or standard JS. If I attempt to fire any ChartJS api events on the chart object (which does actually get created), the API reacts, but doesn't repaint any elements on the screen.
    – Isaac
    Sep 2, 2017 at 4:26

1 Answer 1


We've been using ChartJS 2.1.4 under LockerService with no known issues. What version are you using?

The second error about unsafe-eval is because it violates the CSP unsafe-eval requirement (eval is not supported in any form). This has been part of the published Lightning Security requirements that are now enforced in Spring'17:



  • Hmm, I upgraded to 2.4 and keep getting a "Failed to create chart: can't acquire context from the given item". Looks like I'll need to open another question. None of the 4 variations for defining ctx from chartjs.org/docs seem to be working. Jan 12, 2017 at 1:27
  • @JasonBenkert this looks to be an issue with Locker's implementation of SecureElement.getContext() - should return an instance of CanvasRenderingContext2D and its returning the generic wrapper Locker creates as a fallback. We will get this fixed asap. Jan 12, 2017 at 14:35
  • Created bug W-3624260 to track this and we'll get it triaged/fixed - no workaround currently. Sorry for the inconvenience. Jan 12, 2017 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .