CSP inline-style issue in SvgBundleComponent

surveyjs / survey-library

Free JavaScript form builder library with integration for React, Angular, Vue, jQuery, and Knockout.

https://surveyjs.io/form-library

MIT License

4.1k stars 798 forks source link

CSP inline-style issue in SvgBundleComponent #8714

Open Mat-Sedkowski opened 3 weeks ago

Mat-Sedkowski commented 3 weeks ago

Hello Recently, we bumped our CSP policy to more strict rules, prohibiting any inline-styles. After changing your library from surveyjs-jquery to survey-jquery-ui we managed to resolve most issues. But there is one left in https://dn0mnewxh34wa.cloudfront.net/node_modules/survey-jquery-ui/webpack:/SurveyJquery/src/react/svgbundle.tsx

Can you somehow move that inline style to CSS or add not only SVG icon but also a style component with nonce value read from a proper node on the page? Thanks

tsv2013 commented 3 weeks ago

SurveyJS libraries use inline styles actively. However, replacing only one of them won't solve the CSP issue, while replacing all inline styles will take massive code refactoring and involve breaking changes. For these reasons, I'm going to move this task to backlog for now and see if we can return to it in the future.