adopted-ember-addons / adopted-ember-addons/ember-pikaday

<style> tag fails Content Security Policy

未关闭
#549 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
156
派生
164
PR 合并指标
30 天内没有已合并 PR

描述

ember-pikaday uses a manually applied style tag to set the positioning of the calendar. This is causing it to fail a style-src: 'self CSP and (I think) means to use the add-on you'd need to allow unsafe-inline.

Is there any way to work around this? I have to use the modifier over the component as the project doesn't include moment but from what I can see the style tag is applied as part of the adjustPosition() function so it isn't something I can interact with.

EDIT: I've added the SHA for the script tag for my own projection but I'll leave the issue up as it may be something that can be changed.

贡献指南

打开贡献指南

调研方向

Start by locating adjustPosition(), then trace where the calendar's manually applied style tag is created and how its positioning is tested. Done means the calendar still positions correctly without requiring unsafe-inline under the reported style-src: 'self' CSP.

由索引模型根据 Issue 内容生成。

评估

技术栈
javascript
领域
frontend, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。