Please remove inline styling from DWC

Nxt-1 · 8 May 2022, 21:55

I just took the time to upgrade to the RRF3.4 softwarebundle and after upgrading I noticed some parts of DWC look weird. A quick look in the chrome development console explained what was going on: certain styles are being blocked.

To give some context, my Duet sits bevind a reverse proxy and part of security measures is the content security policy header (= CSP). This is a system that lets you control what scripts (eg JS and CSS) are allowed to be loaded on your site.
A part of normal CSP behaviour is blocking all inline scripts. This didn't use to be an issue since DWC propery separated it's scripts, but it seems like since DWC 3.4 this is no longer the case in some spots. My chrome reports index.tx:169, index.ts:73 and Cart.js:7716 as violations.

For now, I have allowed the specific hashes of the files in my CSP header to have a workaround. Yet this is far from idial as it is clunky and the files are bound to change in the future, requiring manual intervention each time.

I hope this can be fixed.

-Nxt

chrishamm · 9 May 2022, 08:48

@nxt-1 There is no static inline style in DWC but there are four references to dynamic styles in DWC where CSS properties are computed via JavaScript.

Are you sure these violations originate from DWC? I'm asking because none of the files are present in the DWC sources.

Nxt-1 · 10 May 2022, 21:56

@chrishamm I guess they are new or updated dependencies that DWC uses. I am not sure how I can find out what they belong to appart from the two screenshots I've added that seem to show somewhat of a path?

chrishamm · 11 May 2022, 08:36

@nxt-1 Right, that's a dependency of DWC and it's used by the temp+layer charts and the IS+CL plugins. I'll check if I can upgrade that one as part of DWC 3.5.