Configuring ember-cli 3.5's content security policy, CSP

I have this error in my ember-cli build app: Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à eval (« script-src »).

The error is in vendor.js, referring to lines made with webpack and broccoli. I cannot understand why the built js would take files from /tmp/, so I am guessing that the app is trying to get files from my hard drive in /tmp/, which is madness for a website.

I did configure the content security policy with these options:

//in the file config/environment.js
/* eslint-env node */
'use strict';

module.exports = function(environment) {
  let ENV = {
// ...

    contentSecurityPolicy: {
      'script-src': ["self", 'unsafe-eval','unsafe-inline'],
      'img-src': "'self'",
    },
// ...

But it doesn't change the CSP in my build. It breaks the JS and my app cannot load fully. What did I miss?