Content Security Policy (CSP) blocks application of inline styles

[Identekit]

Type of bug

• Differences between Can I use & Modernizr
• False positive
• Modernizr error

Describe the bug
Code within modernizr-2.8.3.js is being blocked by the Content Security Policy because it requires inline execution.

How to Reproduce

1. Apply the following Content-Security-Policy header for the site:
   content-security-policy: default-src 'self'; font-src 'self'; img-src 'self'; style-src 'self';
2. Open the site in Chrome (or browser of your choice)
3. Press 'F12' to open the Developers Console and view the Console
4. Refresh the site.
5. Observe errors in the Console.
   
   

Expected behavior
modernizr functionality is not blocked by the Content Security Policy.

Additional context
Unfortunately the use of a hash also requires the 'unsafe-inline' which does not prevent malicious inline code.

[Markel]

Hi @Identekit 👋,
Is there any reason why you are using v2.8.3? Also, if it doesn't require too much finicking, could you see if the error continues to happen in the latest version?

Also, let's link #1263 (so everything is better documented :)

[Identekit]

@Markel
Thanks for getting back to me so quickly.

Version 2.8.3 is the most recent version available in NuGet...so that is the version I have. Has this been fixed in a more recent version? If so, when will the latest version be available in NuGet?

I also added a comment to #1263, thanks for linking this back to that.

[Markel]

I actually don't know if this issue has been fixed in newer version, I'm relatively new to the project so those "backlog" issues still get me. Maybe @patrickkettner knows something about it? 🤔

Regarding Nuget (first time I heard about it, I won't go to sleep without learning something new :), there isn't an official release of Modernizr there (as far as I know) and the unofficial package is outdated as previously mentioned. You may want to try an updated version that I found, it's v3.4 which is outdated (from 2017) but definitely newer than the version that you are using, which dates back to mid-2014.

[Identekit]

@Markel
I just loaded in the version you found, (v. 3.4.0) but unfortunately it appears to have the same issues.

[ekulishov]

Is there any new information about this issue? Is there any plan to move on with this?