Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make Sentry error embed form Strict CSP compliant #36503

Open
fliespl opened this issue Jul 11, 2022 · 2 comments
Open

Make Sentry error embed form Strict CSP compliant #36503

fliespl opened this issue Jul 11, 2022 · 2 comments

Comments

@fliespl
Copy link

fliespl commented Jul 11, 2022

Problem Statement

Due to the usage of inline style inside var template, strict csp fails with inline style issue.

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' data: https:". Either the 'unsafe-inline' keyword, a hash ('sha256-zMSqd3IdI0P85bMS1pHPulcrWrNFUbioxKEvO08Bg9I='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

CSP must not include "unsafe-inline" style tags to reproduce problem.

Solution Brainstorm

Extract <style> tag into seperate css file, which would outcome the issue.

@getsentry-release
Copy link

Routing to @getsentry/team-web-sdk-frontend for triage. ⏲️

@lforst
Copy link
Member

lforst commented Jul 14, 2022

Hi! Thanks for the suggestion! :)

Backlogging this. PRs are always welcome!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants