xtermjs/xterm.js

Latest version requires unsafe-inline due to inline styles

开放

#4,445 创建于 2023年3月23日

 (24 条评论) (2 个反应) (0 位负责人)TypeScript (1,574 个派生)batch import
help wantedtype/enhancement

仓库指标

星标
 (16,196 个星标)
PR 合并指标
 (平均合并 2天 10小时) (30 天内合并 16 个 PR)

描述

Content Security Policies need to be set to 'unsafe-inline' to work with xterm.js. Older versions didn't use inline styles so this wasn't an issue.

Ideally xterm should stop using inline styles or support a user-provided nonce value that can be set in the CSP. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src

Details

  • Browser and browser version: all
  • OS version: all
  • xterm.js version: 5.1.0

Steps to reproduce

  1. Set a content security policy like "style-src 'self';"
  2. Make an xterm that has a resizable container
  3. Resizing causes CSP errors in the console.
  4. Resizing doesn't work properly

贡献者指南