Skip to content

Remove unsafe-inline styles requirement#54

Closed
zknpr wants to merge 1 commit intomainfrom
remove-unsafe-inline-styles-6052571533312156332
Closed

Remove unsafe-inline styles requirement#54
zknpr wants to merge 1 commit intomainfrom
remove-unsafe-inline-styles-6052571533312156332

Conversation

@zknpr
Copy link
Copy Markdown
Owner

@zknpr zknpr commented Feb 7, 2026

This change removes the requirement for 'unsafe-inline' styles in the Content Security Policy (CSP).

Previous implementation relied on inline styles for dynamic layout in the data grid and various UI elements. This has been refactored to use:

  1. CSS Classes: Static inline styles in HTML templates and JS strings were replaced with semantic CSS classes defined in viewer.css.
  2. CSSOM: Dynamic styles (column widths, sticky positioning) in grid.js are applied via element.style.property = value, which is allowed by CSP 'self' and does not require 'unsafe-inline'.

Verified by:

  • Automated tests (npm test).
  • Frontend verification script (screenshots of the standalone viewer).
  • Building the extension (npm run compile).

PR created automatically by Jules for task 6052571533312156332 started by @zknpr

Refactored the data grid and other UI components to eliminate the need for 'unsafe-inline' in the Content Security Policy style-src directive.

Key changes:
- Removed `cspUtil.inlineStyle` from `src/editorController.ts`.
- Replaced inline styles with CSS classes in `core/ui/modules/grid.js` and `core/ui/modules/ui.js`.
- Replaced inline styles with CSS classes in `core/ui/viewer.template.html`.
- Added new utility classes to `core/ui/viewer.css` to support the changes.
- Updated `package-lock.json` to match `package.json` version (1.2.7).

Co-authored-by: zknpr <96851588+zknpr@users.noreply.github.com>
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Feb 7, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sq-lite-explorer Ready Ready Preview, Comment Feb 7, 2026 2:07pm

@google-labs-jules
Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@gemini-code-assist
Copy link
Copy Markdown

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@zknpr
Copy link
Copy Markdown
Owner Author

zknpr commented Feb 7, 2026

Merged as part of v1.3.0 release in PR #65

@zknpr zknpr closed this Feb 7, 2026
@zknpr zknpr deleted the remove-unsafe-inline-styles-6052571533312156332 branch February 7, 2026 17:00
@google-labs-jules
Copy link
Copy Markdown
Contributor

Merged as part of v1.3.0 release in PR #65

Acknowledged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant