The use of setAttribute('style', ...) causes CSP violations

[lambdacasserole]

If I use ScrollReveal in a web application served with a Content Security Policy that doesn't include style-src unsafe-inline it doesn't work, because inline style attributes are not permitted and ScrollReveal generates them by using setAttribute('style', ...) in several places, for example here.

Including style-src unsafe-inline isn't considered great practice because it makes XSS (cross-site styling) attacks much easier.

This can be addressed by manipulating element styles using element.style['attr-name'] = '...' instead.

Specs of test machine:

• OS: Windows 10 Home
• Browser: Chrome Version 65.0.3325.181 (Official Build) (64-bit)
• ScrollReveal Version: 3.4.0