Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid setAttribute for CSP compliance #6357

Closed
wants to merge 1 commit into from
Closed

Conversation

evs-ch
Copy link

@evs-ch evs-ch commented May 6, 2019

Proposed changes

Under some circumstances (we experienced this issue with a recent rails and appropriately strict CSP policies, see mkhairi/materialize-sass#186), materialize causes CSP violations.

Using setAttribute('style', style) causes issues with the style policy. element.style = ... is CSP compliant and could be used instead. jQuery offers .css(), which uses the aforementioned .style.
This PR changes the problematic setAttribute calls to using a setStyle() function which checks if jQuery is loaded and uses .css() if possible or falls back to setAttribute.
It might be possible to enhance the function to fall back to looping through the styles and directly applying them with .style = , but I didn't look into that yet.
I "played it safe" with regards to the jQuery check, but maybe .css() is already implemented by whichever way materialize chose to replace/deprecate jQuery, so it might not even be necessary.

Screenshots (if appropriate) or codepen:

/

Types of changes

  • Bug fix (non-breaking change which fixes an issue).
  • New feature (non-breaking change which adds functionality).
  • Breaking change (fix or feature that would cause existing functionality to change).

Checklist:

  • I have read the CONTRIBUTING document.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@acburst
Copy link
Collaborator

acburst commented Jun 1, 2019

We no longer use jQuery as a dependency

@acburst acburst closed this Jun 1, 2019
@evs-ch
Copy link
Author

evs-ch commented Jun 1, 2019

That's good to know, but what about the actual intention of my PR? Should I rewrite it without using jQuery, or is the original problem (CSP violations) a thing that you are not interested in getting fixed? And if it should be rewritten: is there something else implementing .css() used in materialize? Otherwise, I'd need to rewrite the relevant method with plain JS, which should be possible but might be unneccessary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants