search

clarkwinkelmann / flarum-ext-emojionearea

Add EmojioneArea emoji picker to Flarum
https://discuss.flarum.org/d/4787
MIT License
27 stars 12 forks source link

data: image cause CSP header issues #2

Open clarkwinkelmann opened 7 years ago

clarkwinkelmann commented 7 years ago

The EmojiOne Area plugin uses a data: image in the CSS for the default button.

In my extension this default icon is hidden and another is used with the core icon() helper.

But the image is still in the CSS and still triggers CSP error if data: is not allowed by the img-src rule. It does not prevent the use of the plugin, but it will spam the CSP report URI if enabled.

It might be a good idea to extract the useful parts of the CSS into extension.less and not import all the original rules.

clarkwinkelmann commented 7 years ago

The data-image is also used for the triangle under the popup. This one is still used and disapears if CSP blocks it.