react-component / react-component/util
【CSP once is not effective 】util/src/Dom/dynamicCSS injectCSS function with csp bug,Style.once is not effective
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 670
- Forks
- 205
- Avg merge
- 11d 17h
- Merged PRs (30d)
- 4
Description
util/src/Dom/dynamicCSS injectCSS function ，Style.once only assigns attributes and is still blocked by CSP policies. Style.setAttribute should be used to set nonce to the dom tree.
The following example also illustrates that using. xx assignment does not reflect on the dom tree, and using setAttribute will reflect on the dom tree
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin in util/src/Dom/dynamicCSS at injectCSS and review the CSP examples in the issue. Compare how Style.once sets the nonce with the DOM representation shown; done means the nonce is reflected on the style element so CSP no longer blocks the injected style while once behavior remains effective.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100