xtermjs/xterm.js
Latest version requires unsafe-inline due to inline styles
オープン
#4,445 opened on 2023/03/23
help wantedtype/enhancement
Repository metrics
- Stars
- (16,196 個のスター)
- PR merge metrics
- (平均マージ 2d 10h) (30d で 16 merged PRs)
説明
Content Security Policies need to be set to 'unsafe-inline' to work with xterm.js. Older versions didn't use inline styles so this wasn't an issue.
Ideally xterm should stop using inline styles or support a user-provided nonce value that can be set in the CSP. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
Details
- Browser and browser version: all
- OS version: all
- xterm.js version: 5.1.0
Steps to reproduce
- Set a content security policy like "style-src 'self';"
- Make an xterm that has a resizable container
- Resizing causes CSP errors in the console.
- Resizing doesn't work properly