You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am trying to make my django project, which is using crispy_bootstrap5, as tight as possible wrt CSP.
However, I noticed one CSP problem inside crispy_forms, which tracks down to a template in crispy_bootstrap5.
I am trying to make my django project, which is using crispy_bootstrap5, as tight as possible wrt CSP.
However, I noticed one CSP problem inside crispy_forms, which tracks down to a template in crispy_bootstrap5.
In
templates/bootstrap5/layout/field_file.html
you use an inline-style, which is strongly would require the strongly discouraged CSP Option:
style-src = 'unsafe-inline'
An alternative to fix this would be to replace the explicit style attribute by an extended
class="text-break flex-grow-1"
or similar.Would it be possible to consider this, so that web pages using crispy_forms can be made more secure?
Thanks for the consideration
The text was updated successfully, but these errors were encountered: