vercel / vercel/next.js

CSP error when using next/image

Open
#45,184 20 comments 22 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
142k
Forks
32.4k
Avg merge
2d 14h
Merged PRs (30d)
351

Description

Verify canary release
  • I verified that the issue exists in the latest Next.js canary release
Provide environment information

Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 21.6.0: Sun Nov 6 23:29:57 PST 2022; root:xnu-8020.240.14~1/RELEASE_ARM64_T8101
Binaries:
Node: 18.12.1
npm: 9.3.1
Yarn: 3.3.1
pnpm: N/A
Relevant packages:
next: 13.1.5-canary.2
eslint-config-next: 13.1.4
react: 18.2.0
react-dom: 18.2.0

Which area(s) of Next.js are affected? (leave empty if unsure)

Image optimization (next/image, next/legacy/image)

Link to the code that reproduces this issue

https://github.com/ennair/next-test/tree/next-image-test

To Reproduce
  1. Checkout the project.
  2. Run yarn
  3. Run yarn build
  4. Run yarn start
  5. Open localhost:3000
  6. You will see the page loading with an image and in the console a CSP error.
Describe the Bug

When using next/image it always adds inline styling on the image. It adds: style="color:transparent".
Also in case I add my own styling. Because of this, I get a CSP error. I have to add style-src 'unsafe-inline', which I do not want to add.

Expected Behavior

Next/image should not add inline styling on the image component.

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked next-image-test reproduction: run yarn, yarn build, yarn start, and inspect the page and browser console. Investigate the next/image behavior that produces style="color:transparent" under the reported CSP. Done means the reproduction no longer triggers a CSP error without requiring style-src 'unsafe-inline'.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nextjs, react
Domain
frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.