search

mozilla / bedrock

Making mozilla.org awesome, one pebble at a time
https://www.mozilla.org
Mozilla Public License 2.0
1.17k stars 912 forks source link

Remove `unsafe-inline` from `style-src` #14840

Open robhudson opened 1 month ago

janbrasna commented 1 month ago

I'm wondering what to do with https://www.mozilla.org/healthz-cron/ … if the styling is worth any effort to make it CSP-compliant; or just add it as a special path and allow inline styles for it.

This is how it looks with / without styles:

Screen Shot 2024-07-19 at 16 14 09

pass/fail colour can be added with ✅ ❌ emoji, so the only thing eventually missing is the alternate row highlighting for better table readability.

alexgibson commented 1 month ago

Depends on: https://github.com/mozilla/bedrock/issues/14873

alexgibson commented 1 month ago

It also looks like our ancient copy of modernizr also sets some inline styles as part of it's feature detects: https://github.com/mozilla/bedrock/blob/main/media/js/libs/modernizr.custom.inputtypes.js

I wonder if we could remove this as well, as it's (afaik) only used on a couple of old forms.

janbrasna commented 1 month ago

I don't see much or the modernizr really used anywhere, bar for the one instance of hiding date-time inputs on unsupported browsers that's not needed nowadays: #14874