feature: use constructed style sheets for dom render so that it works with csp style-src 'self'#4611
feature: use constructed style sheets for dom render so that it works with csp style-src 'self'#4611Tyriar merged 4 commits intoxtermjs:masterfrom SimonSiefke:constructed-stylesheets
Conversation
… with csp style-src 'self'
|
I updated the branch |
|
This seems to make the Linux/Firefox integration tests consistently fail. You can run these with |
|
Fixed! :) |
|
@SimonSiefke Can you plz also check, that |
|
@jerch I get the impression
|
|
@jerch As far as I understand, there is no extra synchronization in
As @Tyriar said, it is basically the same, both methods are dom writes, there are no extra forced layouts with this method. Perhaps performance might even be slightly better because there are two less dom elements now, which is also something but I doubt it would make a huge difference. |
|
@SimonSiefke thanks again, this was a great change as I know several people have hit the CSP issue |
|
I stumbled over one aspect in this PR when merging the DOM renderer PR with master - in Question - should the code in |
|
@jerch good find, I'll fix it up |
|
6.0.0 still relies on inline styles. A previous fix was reverted upstream, so this is a known limitation. Is there any recommended workaround or planned fix to avoid requiring style-src 'unsafe-inline'? |

Fixes #4445
This changes the dom renderer to use constructed stylesheets instead of html style elements when available. Constructed stylesheets don't require a
style-src 'unsafe-inline'Content Security Policytest the change locally
Demo with CSP enabled