hypothesis / hypothesis/product-backlog

Fix client issues that interfere with strict CSP policies

Open
#204 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
122
Forks
7
PR merge metrics
No merged PRs in 30d

Description

## Bug report form

### Steps to reproduce
1. Go to https://qa.hypothes.is/docs/help
2. Check console for CSP errors

### Expected behaviour
No CSP errors.

### Actual behaviour
CSP errors are triggered by:

1. Inline styles inserted into the host page by `adder.js`
2. Inline styles inserted into app.html when rendering LaTeX markup using KaTeX.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the CSP errors at https://qa.hypothes.is/docs/help and inspect the inline styles inserted by adder.js and app.html when KaTeX renders LaTeX. Trace both sources and verify completion by confirming that the page renders without CSP errors under the strict policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
html, javascript
Domain
security, web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.