[X] I have searched the issue tracker for a bug report that matches the one I want to file, without success.
What package is this bug report for?
rrweb
Version
2.6.0
Expected Behavior
I would expect that even with a strict CSP policy (e.g. style-src 'nonce-${SOME_NONCE}), I would still be able to successfully capture replays. (See a similar issue in a different package)
Actual Behavior
A CSP error occurs due to use of setAttribute('style', ...)here
Steps to Reproduce
Set up a vue project that uses Sentry with replays enabled and a strict CSP policy (e.g. style-src 'nonce-${SOME_NONCE})
Write a basic component that uses `:style="{ 'background-color': someDynamicVariable }"
Deploy the application, trigger an error so a replay begins and update someDynamicVariable - observe how a CSP error occurs
Testcase Gist URL
No response
Additional Information
There might be a simpler way to reproduce the issue, but I've described the setup we observed the issue in. Without any knowledge of what the culprit code is actually trying to do, its hard for me to provide a more concise reproduction.
Preflight Checklist
What package is this bug report for?
rrweb
Version
2.6.0
Expected Behavior
I would expect that even with a strict CSP policy (e.g.
style-src 'nonce-${SOME_NONCE}), I would still be able to successfully capture replays. (See a similar issue in a different package)Actual Behavior
A CSP error occurs due to use of
setAttribute('style', ...)hereSteps to Reproduce
style-src 'nonce-${SOME_NONCE})someDynamicVariable- observe how a CSP error occursTestcase Gist URL
No response
Additional Information
There might be a simpler way to reproduce the issue, but I've described the setup we observed the issue in. Without any knowledge of what the culprit code is actually trying to do, its hard for me to provide a more concise reproduction.