Skip to content

Commit 7ad7cb4

Browse files
committed
Stop requiring style-src 'unsafe-inline' CSP
Addresses xobotyi#171. Setting the `style` attribute on an element violates stricter CSP and requires a policy of `style-src 'unsafe-inline'`. Setting each style in the style property of the element resolves this issue.
1 parent 95b17d1 commit 7ad7cb4

File tree

1 file changed

+15
-9
lines changed

1 file changed

+15
-9
lines changed

src/util.tsx

+15-9
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,15 @@ interface GetScrollbarWidthFN {
218218
(force?: boolean): number | undefined;
219219
}
220220

221+
const setWidthDetectorStyle = (el: HTMLDivElement) => {
222+
el.style.position = 'absolute';
223+
el.style.width = '100px';
224+
el.style.height = '100px';
225+
el.style.top = '-999px';
226+
el.style.left = '-999px';
227+
el.style.overflow = 'scroll';
228+
}
229+
221230
/**
222231
* @description Returns scrollbar width specific for current environment. Can return undefined if DOM is not ready yet.
223232
*/
@@ -233,10 +242,7 @@ export const getScrollbarWidth: GetScrollbarWidthFN = (force = false): number |
233242
}
234243

235244
const el = doc.createElement('div');
236-
el.setAttribute(
237-
'style',
238-
'position:absolute;width:100px;height:100px;top:-999px;left:-999px;overflow:scroll;'
239-
);
245+
setWidthDetectorStyle(el);
240246

241247
doc.body.append(el);
242248

@@ -277,11 +283,11 @@ export const shouldReverseRtlScroll: ShouldReverseRtlScroll = (force = false): b
277283

278284
el.append(child);
279285

280-
el.setAttribute(
281-
'style',
282-
'position:absolute;width:100px;height:100px;top:-999px;left:-999px;overflow:scroll;direction:rtl'
283-
);
284-
child.setAttribute('style', 'width:1000px;height:1000px');
286+
setWidthDetectorStyle(el);
287+
el.style.direction = 'rtl';
288+
289+
child.style.width = '1000px';
290+
child.style.left = '1000px';
285291

286292
doc.body.append(el);
287293

0 commit comments

Comments
 (0)