Error thrown by Content-Security-Policy

[dracos]

Error thrown by Content-Security-Policy

[dracos]

Hmm, https://developer.mozilla.org/en-US/docs/Web/API/Element/setAttribute actually says:

Since the specified value gets converted into a string, specifying null doesn't necessarily do what you expect. Instead of removing the attribute or setting its value to be null, it instead sets the attribute's value to the string "null". If you wish to remove an attribute, call removeAttribute().

So perhaps setting it to null is not the right thing to do, and the bug is here, not Firefox.

[gr8bit]

Your CSP seems to forbid the execution of inlined javascript. Therefore you won't be able to execute ANY javascript that's in the HTML of the page, be it between <script> tags or in an element's attribute (e.g. "onload").

[dracos]

You can run inline javascript within a <script> tag if you provide a nonce. Which is what I was doing, which is what led to me opening this ticket.

[gr8bit]

Oh, I overlooked that the source is actually in loadCSS, my bad. Did you (or Firefox) solve it in the meantime?

[dracos]

No, I still get the CSP error in Firefox running that line (you can see it on https://www.fixmystreet.com/ for example). I should probably switch to the removeAttribute thing I suggest here, I guess I thought it would get merged by now.