From 3a380754257c5d9864481002e1e940bac3742307 Mon Sep 17 00:00:00 2001 From: Carl Mercier Date: Fri, 4 Sep 2026 13:11:09 -0500 Subject: [PATCH 1/2] Render the dashboard without inline style attributes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A nonce cannot rescue an inline `style` attribute: those are governed by style-src-attr, which falls back to style-src, so under a strict `style-src 'self'` the table column widths collapsed and the queue depth bars disappeared. Column widths and the failed-jobs error cell move into role-named rules in input.css next to the other `table.fd-data` rules; the processes hostname cell drops a `font-size:12px` that `.dim` already set. The depth bar — the one dynamic width — becomes a server-rendered SVG like the adjacent sparkline, where `width` on a `` is a geometry attribute CSP never inspects. `test/integration/csp_inline_styles_test.rb` crawls every dashboard page, every jobs state, and both job detail paths, and fails on any rendered `style` attribute. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 2 + ...e6c4b8.css => flightdeck-38ba36531cee.css} | 2 +- app/assets/flightdeck/manifest.json | 8 +-- .../flightdeck/jobs/_failed_row.html.erb | 2 +- app/views/flightdeck/jobs/_list.html.erb | 6 +- .../flightdeck/overview/_queues.html.erb | 9 +-- .../flightdeck/processes/_fleet.html.erb | 2 +- app/views/flightdeck/processes/_row.html.erb | 2 +- .../recurring_tasks/_table.html.erb | 2 +- assets-src/input.css | 10 ++- test/integration/csp_inline_styles_test.rb | 61 +++++++++++++++++++ 11 files changed, 88 insertions(+), 18 deletions(-) rename app/assets/flightdeck/{flightdeck-ad6cd9e6c4b8.css => flightdeck-38ba36531cee.css} (62%) create mode 100644 test/integration/csp_inline_styles_test.rb diff --git a/CHANGELOG.md b/CHANGELOG.md index 753c6cc..9caa01f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Policy. The layout now renders `csp_meta_tag`, so the bundled Turbo can nonce the `