adopted-ember-addons / adopted-ember-addons/ember-pikaday
<style> tag fails Content Security Policy
- 主要语言
- JavaScript
- 星标
- 156
- 派生
- 164
- PR 合并指标
- 30 天内没有已合并 PR
描述
ember-pikaday uses a manually applied style tag to set the positioning of the calendar. This is causing it to fail a style-src: 'self CSP and (I think) means to use the add-on you'd need to allow unsafe-inline.
Is there any way to work around this? I have to use the modifier over the component as the project doesn't include moment but from what I can see the style tag is applied as part of the adjustPosition() function so it isn't something I can interact with.
EDIT: I've added the SHA for the script tag for my own projection but I'll leave the issue up as it may be something that can be changed.
贡献指南
调研方向
Start by locating adjustPosition(), then trace where the calendar's manually applied style tag is created and how its positioning is tested. Done means the calendar still positions correctly without requiring unsafe-inline under the reported style-src: 'self' CSP.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- javascript
- 领域
- frontend, security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 需要澄清
- 新手友好度
- 35/100