You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The getScrollBarSize function in rc-util dynamically injects CSS using updateCSS for measuring scrollbar size. However, it does not respect the nonce value provided via the ConfigProvider's csp property. This leads to CSP violations in environments with strict style-src policies.
Steps to Reproduce
Set up a project using antd with a ConfigProvider configured to include a nonce value:
<ConfigProvidercsp={{nonce: 'test-nonce',}}>
Use a component that indirectly triggers the getScrollBarSize function (i.e. Table from rc-table)
Observe CSP violations in the browser console, such as:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-test-nonce'".
Expected Behavior
The getScrollBarSize function should respect the configured nonce by passing it to the updateCSS function when dynamically injecting styles.
Affected Code
The relevant part of the getScrollBarSize.tsx, line 49:
The
getScrollBarSize
function inrc-util
dynamically injects CSS usingupdateCSS
for measuring scrollbar size. However, it does not respect thenonce
value provided via theConfigProvider
'scsp
property. This leads to CSP violations in environments with strictstyle-src
policies.Steps to Reproduce
antd
with aConfigProvider
configured to include anonce
value:getScrollBarSize
function (i.e.Table
fromrc-table
)Expected Behavior
The
getScrollBarSize
function should respect the configurednonce
by passing it to theupdateCSS
function when dynamically injecting styles.Affected Code
The relevant part of the
getScrollBarSize.tsx
, line 49:Additional info
This issue was first introduced in the following commit: Commit Hash:
e96b0c6
The text was updated successfully, but these errors were encountered: