videojs / videojs-youtube

YouTube playback technology for Video.js
1.12k stars 548 forks source link

Feat: CSP Issues with setting inline style #621

Open sal-gassen opened 4 months ago

sal-gassen commented 4 months ago

Setting style or cssTexT attribute directly violates the CSP style-src-attr.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src-attr#violation_cases

This issue is resolved by setting the properties individually, e.g. div.style.width = "100%"

But the YouTube iFrame API (www-widgetapi.js) copies the styles from the videojs div to the iframe which results in CSP violations again. This is why all inline styles are wrapped in the window.VIDEOJS_NO_DYNAMIC_STYLE flag provided by videojs

https://videojs.com/guides/skins/#disabling-additional-style-elements