adopted-ember-addons / adopted-ember-addons/ember-pikaday
<style> tag fails Content Security Policy
- Vorherrschende Sprache
- JavaScript
- Sterne
- 156
- Forks
- 164
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
ember-pikaday uses a manually applied style tag to set the positioning of the calendar. This is causing it to fail a style-src: 'self CSP and (I think) means to use the add-on you'd need to allow unsafe-inline.
Is there any way to work around this? I have to use the modifier over the component as the project doesn't include moment but from what I can see the style tag is applied as part of the adjustPosition() function so it isn't something I can interact with.
EDIT: I've added the SHA for the script tag for my own projection but I'll leave the issue up as it may be something that can be changed.
Beitragsleitfaden
Rechercherichtung
Start by locating adjustPosition(), then trace where the calendar's manually applied style tag is created and how its positioning is tested. Done means the calendar still positions correctly without requiring unsafe-inline under the reported style-src: 'self' CSP.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- javascript
- Bereich
- frontend, security
- Issue-Typ
- Bug
- Schwierigkeit
- 4/5
- Geschätzter Aufwand
- 3-5 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Muss geklärt werden
- Anfängerfreundlichkeit
- 35/100