Use CSSStyleSheet constructor instead of <style> elements #1698
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
When creating the codemirror CSS, it injects style elements into the page.
This doesn't sit well with CSP, which doesn't let me use the CSS unless I add things like "unsafe-eval" for css or other directives.
However, CSSStyleSheet adopted through
document.body.adoptedStylesheet.add(my_stylesheet)do not suffer the same treatment.I think it would be a good move to generate CSS with this instead.
After some digging however, I see that style-mod is used, and that style-mod happy does so. I do not understand why CodeMirror's view does not trigger that mechanism however.
The reason
adoptedStylesheetsisn't used in the top document is that I don't want injected styles to override rules with the same precedence specified in<style>tags. See https://github.com/WICG/construct-stylesheets/issues/93 and #360.I understand.
However, it still breaks CSP-powered sites.
Could there be a case to give an option that would change this behaviour in an opt-in manner ?
Have you tried using
EditorView.cspNonceto get around this issue?