adopted-ember-addons / adopted-ember-addons/ember-pikaday

<style> tag fails Content Security Policy

Offen
#549 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
JavaScript
Sterne
156
Forks
164
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

ember-pikaday uses a manually applied style tag to set the positioning of the calendar. This is causing it to fail a style-src: 'self CSP and (I think) means to use the add-on you'd need to allow unsafe-inline.

Is there any way to work around this? I have to use the modifier over the component as the project doesn't include moment but from what I can see the style tag is applied as part of the adjustPosition() function so it isn't something I can interact with.

EDIT: I've added the SHA for the script tag for my own projection but I'll leave the issue up as it may be something that can be changed.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by locating adjustPosition(), then trace where the calendar's manually applied style tag is created and how its positioning is tested. Done means the calendar still positions correctly without requiring unsafe-inline under the reported style-src: 'self' CSP.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
javascript
Bereich
frontend, security
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.