Content Security Policies need to be set to 'unsafe-inline' to work with xterm.js. Older versions didn't use inline styles so this wasn't an issue.

Ideally xterm should stop using inline styles or support a user-provided nonce value that can be set in the CSP. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src

Details

• Browser and browser version: all
• OS version: all
• xterm.js version: 5.1.0

Steps to reproduce

1. Set a content security policy like "style-src 'self';"
2. Make an xterm that has a resizable container
3. Resizing causes CSP errors in the console.
4. Resizing doesn't work properly