Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid setAttribute for CSP compliance #186

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

evs-ch
Copy link

@evs-ch evs-ch commented Apr 1, 2019

We're using materialize-sass with Rails with a strict CSP config. Using setAttribute('style', style) causes issues the style policy. element.style = ... is CSP compliant and could be used instead. jQuery offers .css(), which uses the aforementioned .style.
This PR changes the problematic setAttribute calls to using a setStyle() function which checks if jQuery is loaded and uses .css() if possible or falls back to setAttribute.
It might be possible to enhance the function to fall back to looping through the styles and directly applying them with .style = , but I didn't look into that yet.

Using this PR with appropriate settings in Rails' content_security_policy.rb at least fixed all the CSP conflicts we had with materialize-sass.

@mkhairi
Copy link
Owner

mkhairi commented Apr 10, 2019

Hi @evs-ch, Thanks for pr. Would you mind to make this pr to the official materializecss repo instead of here? I will update this assets base on official repo. Thanks again.

@evs-ch
Copy link
Author

evs-ch commented Apr 27, 2019

Makes sense, I'll do that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants