[Rendering] CSP issue in TextBlock rendering

Target Platforms

Other

SDK Version

2.9.0

Application Name

N/A

Problem Description

Hi,

We are using the MS AdaptiveCards and we have issue running our application with strict CSP, more precisely - style-src 'self' option.
https://www.w3.org/TR/CSP2/

Our issue is caused by this block of code:
https://github.com/microsoft/AdaptiveCards/blob/main/source/nodejs/adaptivecards/src/card-elements.ts
rows 1026 – 1043

As far as we could determine, this was added for an Outlook scenario requested via this issue:
#1934
and added with this pull request:
#2152

So our questions are:

Can you please let us know if the code block mentioned in card-elements.ts file can be considered deprecated?
Also, are there plans for it to be removed as per the statement in the pull request and the fact that the Inline text runs #1933 is finished and there is already way to do that with the RichTextBlock?
If the answer to 2 is ‘No’, could you please have a look into this issue and make it working in a strict CSP compliant way?
Why do we believe this is an issue:
The flag (GlobalSettings.allowMarkForTextHighlighting), which controls this feature and allows for the particular block of code to become executable is stored as static variable.
Someone can require the bundled file, we serve and change this for the entire application.

You can check a very simplified jsbin code sample provided in the issue.

Best Regards,
Hristo

Screenshots

No response

Card JSON

{
    "type": "AdaptiveCard",
    "version": "1.0",
    "body": [
        {
            "type": "TextBlock",
            "text": "Hello <mark>Adaptive</mark> Cards!"
        }
    ]
  }

Sample Code Language

JavaScript

Sample Code

https://jsbin.com/riqezunowe/1/edit?js,output

Start with source/nodejs/adaptivecards/src/card-elements.ts lines 1026–1043 and reproduce the behavior using the linked JSBin sample under a strict style-src 'self' CSP. Read issues #1934 and #1933 plus pull request #2152 to determine the intended status of the highlighting block; done means its disposition is clarified and the reported CSP behavior is addressed or documented.