Revert "fix: apply StyleProvider nonce to CSS variable styles"#254
Revert "fix: apply StyleProvider nonce to CSS variable styles"#254
Conversation
This reverts commit ec07fb1.
|
🎊 PR Preview 4f8f36a has been successfully built and deployed to https://ant-design-cssinjs-preview-pr-254.surge.sh 🕐 Build time: 96.899s
🤖 By surge-preview |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 Walkthrough高级走查（Walkthrough）本PR移除了样式上下文中的nonce（内容安全策略）相关功能，包括从StyleContextProps中删除nonce属性、移除mergeCSSConfig工具函数、清理CSS注册和缓存令牌钩子中的nonce处理，并删除相应的测试用例。同时添加了autoPrefix布尔属性。 变更（Changes）
代码审查工作量估计🎯 2 (简单) | ⏱️ ~12 分钟 诗歌
✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request fully reverts a previous change that introduced Content Security Policy (CSP) nonce support for CSS variable styles. The primary impact is the removal of the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #254 +/- ##
==========================================
- Coverage 94.71% 94.65% -0.07%
==========================================
Files 32 32
Lines 2859 2823 -36
Branches 453 448 -5
==========================================
- Hits 2708 2672 -36
Misses 151 151 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request reverts the changes introduced in ant-design/cssinjs#252, which aimed to apply nonce to CSS variable styles. This revert, while technically clean, introduces a significant security regression by breaking support for strict Content Security Policies. Specifically, it removes the nonce property from StyleContextProps, eliminates the mergeCSSConfig utility, and updates useCSSVarRegister and useCacheToken hooks to no longer handle nonce for CSS variable injection. Furthermore, potential CSS injection vulnerabilities were identified where theme token values are injected into style tags without proper sanitization. It is strongly recommended to restore CSP nonce support and implement robust sanitization for all user-controllable token values.
|
|
||
| /** Nonce for CSP (Content Security Policy) */ | ||
| nonce?: string | (() => string); | ||
| } |
There was a problem hiding this comment.
The removal of the nonce property from StyleContextProps is a security regression. This property is essential for applications that implement a strict Content Security Policy (CSP) requiring nonces for inline styles. By removing this property, the library loses the ability to pass nonces to dynamically injected style tags, which will cause them to be blocked by the browser in strict CSP environments. This may force developers to adopt less secure CSP directives like 'unsafe-inline' to maintain functionality.
| const style = updateCSS(cssVarsStr, styleId, { | ||
| mark: ATTR_MARK, | ||
| prepend: 'queue', | ||
| attachTo: container, | ||
| priority: -999, | ||
| }); |
There was a problem hiding this comment.
The cssVarsStr variable, which contains CSS variable definitions derived from theme tokens, is passed directly to the updateCSS sink without sanitization. If token values are user-controlled (e.g., in a customizable theme), an attacker can inject arbitrary CSS rules by including characters like ; or } in the token value. This can lead to UI redressing or data exfiltration via CSS-based attacks.
| const style = updateCSS(cssVarsStr, hash(`css-var-${themeKey}`), { | ||
| mark: ATTR_MARK, | ||
| prepend: 'queue', | ||
| attachTo: container, | ||
| priority: -999, | ||
| }); |
There was a problem hiding this comment.
Theme token values are injected into the document via updateCSS without sanitization. This allows for CSS injection if the theme tokens or overrides contain malicious content. An attacker could exploit this to manipulate the page's appearance or exfiltrate sensitive information using CSS selectors and external resources.
1 participant
Reverts #252
Summary by CodeRabbit
发行说明