Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSP3: Consider adding a 'resource-src' directive #198

Open
jwatt opened this issue Mar 19, 2017 · 0 comments
Open

CSP3: Consider adding a 'resource-src' directive #198

jwatt opened this issue Mar 19, 2017 · 0 comments
Milestone
Future

Comments

@jwatt
Copy link

jwatt commented Mar 19, 2017

SVG has the concept of resource documents, where an external document can contain things like markers, filters, gradients, etc., and other documents can link, say, the 'marker' CSS property to an anchor in the external document. UAs then load the external document, and draw the external marker as appropriate. Perhaps image-src should cover this case, but we should look at it more closely. At any rate, filing this while I remember.
@mikewest mikewest modified the milestone: CSP3 CR May 9, 2017
@andypaicu andypaicu modified the milestones: CSP3 CR, Future Jan 9, 2018
@Malvoz Malvoz mentioned this issue Sep 25, 2018
Closed
@Malvoz Malvoz mentioned this issue Sep 15, 2019
Closed
LeSuisse added a commit to Enalean/tuleap that referenced this issue Feb 5, 2021
@LeSuisse
request #19263: Empty and error state illustrations of the taskboard …
38c8bd4 
…are not displayed

The issue happens for two reasons:
* since the v5.0 of file-loader everything is considered to be usable as
  a ES module by default. This does not work in this situation.
* SVG loaded through `<use>` is a bit of grey area in the
  Content-Security-Policy specification [0][1] and a result it does not
  work on Firefox when `default-src` is set to none.

In order to solve the issue while keeping the overall app not too big,
the parts of the SVG have been splitted into individual components and
are loaded asynchronously.

The opportunity has also been taken to optimize the SVGs with SVGO [2].

[0] w3c/webappsec-csp#199
[1] w3c/webappsec-csp#198
[2] https://github.com/svg/svgo

Change-Id: Ia66419a50e73eadaffdd31bf3b1b70a5328592d3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
Future
Development

No branches or pull requests
3 participants
@mikewest @jwatt @andypaicu