{"action":"closed","issue":{"url":"https://api.github.com/repos/rails/rails/issues/32920","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/32920/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/32920/comments","events_url":"https://api.github.com/repos/rails/rails/issues/32920/events","html_url":"https://github.com/rails/rails/issues/32920","id":324175180,"node_id":"MDU6SXNzdWUzMjQxNzUxODA=","number":32920,"title":"Allow Content Security Policy nonce to be inserted into style-src","user":{"login":"FooBarWidget","id":819,"node_id":"MDQ6VXNlcjgxOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/819?v=4","gravatar_id":"","url":"https://api.github.com/users/FooBarWidget","html_url":"https://github.com/FooBarWidget","followers_url":"https://api.github.com/users/FooBarWidget/followers","following_url":"https://api.github.com/users/FooBarWidget/following{/other_user}","gists_url":"https://api.github.com/users/FooBarWidget/gists{/gist_id}","starred_url":"https://api.github.com/users/FooBarWidget/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FooBarWidget/subscriptions","organizations_url":"https://api.github.com/users/FooBarWidget/orgs","repos_url":"https://api.github.com/users/FooBarWidget/repos","events_url":"https://api.github.com/users/FooBarWidget/events{/privacy}","received_events_url":"https://api.github.com/users/FooBarWidget/received_events","type":"User","site_admin":false},"labels":[{"id":107189,"node_id":"MDU6TGFiZWwxMDcxODk=","url":"https://api.github.com/repos/rails/rails/labels/actionpack","name":"actionpack","color":"FFF700","default":false},{"id":41328116,"node_id":"MDU6TGFiZWw0MTMyODExNg==","url":"https://api.github.com/repos/rails/rails/labels/attached%20PR","name":"attached PR","color":"006b75","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-17T20:31:59Z","updated_at":"2018-09-19T23:31:09Z","closed_at":"2018-09-19T23:31:09Z","author_association":"CONTRIBUTOR","body":"Currently, setting `content_security_policy_nonce_generator` in `initializers/content_security_policy.rb` results in the nonce being inserted into `script-src`. However, [JSS](https://github.com/cssinjs/jss/blob/v9.8.1/docs/csp.md) and [Material UI](https://material-ui-next.com/guides/csp/) use Javascript to activate CSS rules, which in turn requires the nonce to be set in `style-src`.\r\n\r\n`action_dispatch/http/content_security_policy.rb` currently hard codes support for script-src in both [5.2.0](https://github.com/rails/rails/blob/v5.2.0/actionpack/lib/action_dispatch/http/content_security_policy.rb#L26) and [master](https://github.com/rails/rails/blob/1007191f31d7ce8486f1f32a5d700bbac66ae242/actionpack/lib/action_dispatch/http/content_security_policy.rb#L135). Please allow customization so that I can use JSS and Material UI."}}
{"actor":{"display_login":"y-yagi"}}