Trix injects a couple of inline <style> blocks into the page <head>: one for the editor itself, and another for the toolbar. Neither block includes a nonce attribute; consequently, the CSP must include 'unsafe-inline' in the style-src directive.
It would be nice to be able to either:
- Have Trix auto-generate
nonce attributes for its inline style blocks, or...
- Preferably, eliminate the need for these inline
<style> blocks altogether
Maybe I'm missing the point, but these <style> blocks appear not to contain anything that could not be factored out into the existing trix.css external stylesheet.
Steps to Reproduce
- Use Trix
- Inspect the page source
- See the inline
<style> blocks that Trix has injected
Details
- Trix version: 0.10.1
- Browser name and version: Chromium 56.0.2924.76
- Operating system: Ubuntu 16.04 (64-bit)
Trix injects a couple of inline
<style>blocks into the page<head>: one for the editor itself, and another for the toolbar. Neither block includes anonceattribute; consequently, the CSP must include'unsafe-inline'in thestyle-srcdirective.It would be nice to be able to either:
nonceattributes for its inlinestyleblocks, or...<style>blocks altogetherMaybe I'm missing the point, but these
<style>blocks appear not to contain anything that could not be factored out into the existingtrix.cssexternal stylesheet.Steps to Reproduce
<style>blocks that Trix has injectedDetails