Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rc-util's getScrollBarSize Does Not Respect ConfigProvider's csp.nonce, Causing CSP Violations #613

Open
F4r4m4rz opened this issue Jan 10, 2025 · 0 comments

Comments

@F4r4m4rz
Copy link

The getScrollBarSize function in rc-util dynamically injects CSS using updateCSS for measuring scrollbar size. However, it does not respect the nonce value provided via the ConfigProvider's csp property. This leads to CSP violations in environments with strict style-src policies.


Steps to Reproduce

  1. Set up a project using antd with a ConfigProvider configured to include a nonce value:
    <ConfigProvider
      csp={{
        nonce: 'test-nonce',
      }}
    >
  2. Use a component that indirectly triggers the getScrollBarSize function (i.e. Table from rc-table)
  3. Observe CSP violations in the browser console, such as:
    Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-test-nonce'".
    

Expected Behavior

The getScrollBarSize function should respect the configured nonce by passing it to the updateCSS function when dynamically injecting styles.


Affected Code

The relevant part of the getScrollBarSize.tsx, line 49:

updateCSS(
  `
#${randomId}::-webkit-scrollbar {
${widthStyle}
${heightStyle}
}`,
randomId,
);

Additional info

This issue was first introduced in the following commit: Commit Hash: e96b0c6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant