-
Notifications
You must be signed in to change notification settings - Fork 73
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support CSP for Symbol Loader. #164
Labels
Comments
Another solution would be to change the inline loader script to a JS file that inserts the SVG. Below's example demonstrates:
This would be an alternative to having an SHA hash of the inline Symbol Loader in the CSP directives, which would work with a assets/svg-symbols-loader.js (function() {
var div = document.createElement('div');
div.innerHTML = '{{SYMBOLS}}';
document.body.insertBefore(div, document.body.childNodes[0]);
})(); index.html
Note: it would be nice to minify the JS. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
🍩 Feature Request
Is your feature request related to a problem? Please describe.
Applications with a content security policy that does not include "unsafe-inline" prevent SVG Jar's inline Symbol loader script from executing.
Describe the solution you'd like
A way to include an SHA hash of SVG Jar's inline Symbol loader in CSP directives, working with
ember-cli-content-security-policy
.Describe alternatives you've considered
Include a nonce on the script tag of the inline Symbol loader. This approach wouldn't work because a nonce would need to be unique - generated for each page load.
Manually generating an SHA hash of the inline Symbol loader and pasting it into the CSP directives. The issue is that changes to the inline Symbol loader would invalidate the manually generated SHA hash.
The text was updated successfully, but these errors were encountered: