Progress Bars violate CSP style-src directive unless directive has 'unsafe-inline' in it
Created by: nchelluri
I see this in the docs for v3.3.5 but I'm using an older 3.x version and see the behavior in my application.
From the docs: http://getbootstrap.com/components/#progress
<div class="progress-bar" role="progressbar" aria-valuenow="60" aria-valuemin="0" aria-valuemax="100" style="width: 60%;">
That last attribute, the inline style, causes a CSP violation for me (and I assume anyone else using an effective CSP policy, since 'unsafe-inline'
is considered, well, unsafe).
A bit of searching helped me find an existing workaround for this issue: https://github.com/danielnixon/bootstrap-hacks/blob/master/progressbar.css
One thing to note is that I had to do a round on my percent values in order to make the bootstrap-hacks
package work properly (e.g. aria-valuenow="50.0"
doesn't work but aria-valuenow="50"
does).