Importing DOMPurify results in a CSP violation of inline (“style-src”).

[sikorsky555]

Background & Context

This isn't a huge deal. I haven't noticed any side effects from the CSP violation in Firefox, but when I import DOMPurify, I automatically get a CSP violation in Firefox. I don't have to call a function, just the very nature of importing DOMPurify resulted in the CSP violation.

Bug

Input

N/A

Given output

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).

Expected output

No CSP violation

[cure53]

Hmm, is it possible that this line causes it?

https://github.com/cure53/DOMPurify/blob/master/src/purify.js#L514

[cure53]

I believe we can also replace <style> with a different CDATA element, i.e. <textarea> or <noscript> - will check later and see if we can get that CSP violation to be squished.

[cure53]

I think the problem might be solved now