Hi,
We’re using superfish.js (version 1.4.8) in a production environment with a strict Content Security Policy (CSP). Our policy prohibits 'unsafe-inline' and requires nonce- or hash-based style/script execution:
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self';
However, superfish.js injects inline styles (e.g., element.style.left = "..."), which triggers CSP violations in modern browsers:
Refused to apply inline style because it violates the CSP directive: "style-src 'self'".
Could the library be refactored or updated to support CSP-compatible usage (e.g., avoid setting inline styles)?
Is there a roadmap or workaround for CSP-restricted environments?
CSP compliance is a requirement for us due to regulatory obligations. We’d appreciate any advice or assistance you can offer.
Thanks for your work on this library
Upendra Yadav
Accelya Sol Ltd
Hi,
We’re using
superfish.js(version 1.4.8) in a production environment with a strict Content Security Policy (CSP). Our policy prohibits'unsafe-inline'and requires nonce- or hash-based style/script execution:However, superfish.js injects inline styles (e.g., element.style.left = "..."), which triggers CSP violations in modern browsers:
Refused to apply inline style because it violates the CSP directive: "style-src 'self'".
Could the library be refactored or updated to support CSP-compatible usage (e.g., avoid setting inline styles)?
Is there a roadmap or workaround for CSP-restricted environments?
CSP compliance is a requirement for us due to regulatory obligations. We’d appreciate any advice or assistance you can offer.
Thanks for your work on this library
Upendra Yadav
Accelya Sol Ltd