Use event listener for QR-Code display in CSP compliance purpose

[thican]

In the objective to improve Content Security Policy (CSP) as raised in issue #1513, here a first PR targeting the QR-Code display feature.

I was only able to test it on the current release version, v0.13.0.

[nodiscc]

Hi @thican, thanks
This is an effort to help us get rid of the need to set script-src 'unsafe-inline' in CSP headers, correct?

[thican]

Hello @nodiscc,
First thank you for your work on this project, and also for the other contributors.

You're right, my objective is to make Shaarli runs smoothly with an "hardened" CSP, such as script-src 'self'; and style-src 'self';.
I am also working on other parts of the code, because why not continue then.

However I am not a Web developer, so I might create more issues than fixing. I’ll keep you updated with new PR, or maybe a global PR to answer the issue #1513 globally.

Meanwhile, here my whole CSP (dedicated vhost):

default-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'; connect-src * blob:; script-src 'self'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: blob: https://*; media-src 'self' data: blob: https://*; object-src 'none'; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals

[nodiscc]

works fine, no console warnings
Thank you