Comments (7)
I faced the exact same issue.
from tools.
I may hit the same problem.
I built my Chrome Apps with polymer and vulcanize --csp, and it worked on Chrome 35.
But it looks like Chrome 36 reports csp violation as,
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' chrome-extension-resource:". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
It does not point the right error place, as index.html:1
, but I can reproduce the similar error with <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-eval'; style-src 'unsafe-inline">
even on web apps over the https.
Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
This case, console shows that the error happens at polymer.js:13
.
My Apps imports core-toolbar that vkammerer said it used noscript.
Do you know any workaround for this?
from tools.
Refer to @robdodson comment on Polymer/polymer#613 (comment)
from tools.
Thanks, I'll track related issues.
FYI, I modified core-toolbar to have a dummy script and removed noscript attribute. It works for me as a quick workaround.
from tools.
Thanks @toyoshim ! I was facing the same issue and adding the dummy script with removing the noscript attr solved it for me too.
from tools.
Fixed by Polymer/polymer-bundler@e068dee. Using vulcanize --csp
should result in no inline scripts injected at vulcanize-time or runtime due to noscript
elements.
from tools.
👍
from tools.
Related Issues (20)
- How to add polymer-cli as a dependency without getting puppeteer? HOT 2
- [build]ES6 Bundle errors in browser with extending PolymerElement or mixin HOT 1
- polymer serve error? HOT 1
- web-component-tester-6.9.2 fails to download selenium-server-standalone-3.141.59.jar
- CDN support as build target HOT 1
- web-component-tester fails to install: sinonjs repository not found HOT 7
- Polymer 3 - 'polymer init' is busted on Win10 HOT 4
- PLEASE ARCHIVE THIS REPOSITORY, OR MARK IT AS MAINTENANCE HOT 2
- Polymer serve's --component-url option has no effect HOT 1
- [gen-ts-declarations] Transitive mixins from external packages are not discovered HOT 1
- The last version of winston library(3.3.1) is breaking web-component-tester
- [gen-ts-declarations] Preserve JSDoc tags for properties HOT 2
- Handle invalid routing for polymer serve HOT 1
- [modulizer] wct-browser-legacy does not pass yarn install --flat HOT 1
- polymer build is not working for windows 10 and node >= v15 HOT 1
- web-component-tester compatibility with jsx based components HOT 1
- 76 vulnerabilities (1 low, 25 moderate, 47 high, 3 critical)
- The "[email protected]" tag is missing.
- FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory HOT 1
- WCT: "TypeError: Cannot read property 'match' of undefined" HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tools.