Closed KminekMatej closed 1 month ago
Tracy does not support CSP style-src, as stated in the documentation https://github.com/nette/tracy?tab=readme-ov-file#content-security-policy.
The thing is, one aspect is Tracy's support, but all user panels, which often use custom styles, would also need to start supporting it. Besides, I don't see much useful benefit in using style-src.
Version: 2.10.7
Bug Description
Debug bar is broken when specifying CSP rules in config.neon. Probable cause is by loading![obrazek](https://github.com/user-attachments/assets/f0b7981f-a7dd-4b86-9041-bd2e179aa3d6)
<style class="tracy-debug">
, which CSP effectively blocks, due tostyle-src: [nonce, *, unsafe-inline]
There is an insight in console:Content-Security-Policy: Nastavení stránky zablokovalo načítání zdroje na inline („style-src“).
Steps To Reproduce
Add to config file:
Expected Behavior
Bar dumps should look all the same as when CSP is not used
Possible Solution
<style class="tracy-debug">
must contain nonce when its configured in CSP. However Im not sure how to propagate CSP setting from config file into phtml templates - thats why I cannot attach pull request along this issue