xtermjs/xterm.js

Latest version requires unsafe-inline due to inline styles

開放

#4,445 建立於 2023年3月23日

 (24 則留言) (2 個反應) (0 位負責人)TypeScript (1,574 個分叉)batch import
help wantedtype/enhancement

倉庫指標

星標
 (16,196 顆星)
PR 合併指標
 (平均合併 2天 10小時) (30 天內合併 16 個 PR)

描述

Content Security Policies need to be set to 'unsafe-inline' to work with xterm.js. Older versions didn't use inline styles so this wasn't an issue.

Ideally xterm should stop using inline styles or support a user-provided nonce value that can be set in the CSP. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src

Details

  • Browser and browser version: all
  • OS version: all
  • xterm.js version: 5.1.0

Steps to reproduce

  1. Set a content security policy like "style-src 'self';"
  2. Make an xterm that has a resizable container
  3. Resizing causes CSP errors in the console.
  4. Resizing doesn't work properly

貢獻者指南