[WIP] Add a Content Security Policy to our docs#1472
[WIP] Add a Content Security Policy to our docs#1472chandlerprall wants to merge 5 commits intoelastic:masterfrom
Conversation
c2e6aca to
1c63c25
Compare
kobelb
left a comment
There was a problem hiding this comment.
CSP directive looks good!
|
@epixa as you've been working through enabling CSP in Kibana, have you had a chance to determine the feasibility of us getting rid of style's 'unsafe-inline', is this something we should be removing from EUI preventatively? |
|
I think we can get rid of unsafe-inline, and EUI should definitely be proactive about removing it. |
|
Please, take a look also at the EUIColorPicker that can break the CSP security |
@snide what do we want to do with the color picker? |
Make our own. Deprecate the old one. I think we should start simple with a limited swatch selector and something that works with custom hex code. I don't think we really need the color selector stuff and its a bit of overkill (@cchaos?). If people agree with that premise, my old PR solved that, assuming i can get it running again. |
|
|
|
What’s the current status here? |
|
@epixa on hold; we've addressed all of the known issues apart from |
|
Closing this; finishing the CSP work is a big TODO for early 2020, will open a new PR on this when additional items have been addressed. |
Summary
Relates to #1431 . This adds a Content Security Policy to the EUI docs for testing our compatibility against a strict setup.
@alexbrasetvik is this policy strict enough for testing with?
<style>tags - this is otherwise handled by a consuming application (Cloud, Kibana).remaining work
There are a handful of components that useReact, since v15, already applies styles through the JS DOM APIstyleattributes, this fails the no-inline-style policy and need to be updated.styleelements into the DOM