Set the `nonce` attribute on inline style tags created by the output processor
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.9k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Content security policies can specify a value for the nonce that must be present on all inline styles, in the style-src part of the directive. When a nonce is specified, the unsafe-inline directive is ignored.
The idea is to prevent styles included in user-supplied content from being applied. The nonce should be different each time the page is loaded, so this only protects against content that doesn't change with each page load.
The Google closure library resolves this by finding a <script> tag in the page with the nonce attribute, and using that. There isn't always one of those, so it should be possible to pass it as an option in the MathJax config, too.
I'm looking at this today to get the MathJax integration on mastodon working, so I might have a pull request soon.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the output processor paths that create inline style tags and review how MathJax configuration options are defined. Check how a nonce could be obtained from a page script tag or passed through configuration, then verify that generated inline styles receive it in both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100