Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Table breaks when using strict CSP-headers #1266

Open
1 task done
mjulstein opened this issue Oct 14, 2024 · 0 comments
Open
1 task done

Table breaks when using strict CSP-headers #1266

mjulstein opened this issue Oct 14, 2024 · 0 comments

Comments

@mjulstein
Copy link

material-react-table version

3.0.1

react & react-dom versions

18

Describe the bug and the steps to reproduce it

Matrial UI officially has a guide to how to implement CSP:
https://mui.com/material-ui/guides/content-security-policy/#how-does-one-implement-csp

This works for the most part, but in some places that are hardly noticeable it breaks.
For the most part the inline styles are done via <style> elements that nonce can be applied to.
However sometimes the styles are applied via attributes, and those are not compatible with CSP v3 nonce.

Initial rendered example with CSP nonce:
image

Disabling inline styles manually give same result:
image

Enabling inline styles manually give the expected result:
image

From what I can see is that making fallback versions of the generated css in a style tag could be a work around. ie:

<style nonce={my-nonce}> { fallback css here } </style>

However I do see that mui manages to insert the the emotion styles some places in the table, but not where the table root gets it's inline styles.
image

This should be done in a similar way for the css variables, so that we can pass nonce to the table as a prop, and no have to hack it in.

Minimal, Reproducible Example - (Optional, but Recommended)

I don't know how I would be able to make an example of this.
We are using nextjs to server side render our app,
a basic table should do.

Screenshots or Videos (Optional)

Included above

Do you intend to try to help solve this bug with your own PR?

None

Terms

  • I understand that if my bug cannot be reliably reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant