Bug Report
When using a content security policy (see policy below), I get an error like this:
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277
docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument.<anonymous> (docsify.js:9277:39)
If I remove the trused type policy from the header I still get this error:
docsify.js:8535
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.
Steps to reproduce
Enable custom response headers on your server. Use the following Content Security Policy:
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
What is current behaviour
Errors as shown above.
What is the expected behaviour
Docsify should work normally irrespective of CSP header.
Other relevant information
The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)
- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:
Please create a reproducible sandbox
I would but I am not sure how to simulate/modify HTTP headers in a sandbox!
Bug Report
When using a content security policy (see policy below), I get an error like this:
If I remove the trused type policy from the header I still get this error:
Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.
Steps to reproduce
Enable custom response headers on your server. Use the following Content Security Policy:
What is current behaviour
Errors as shown above.
What is the expected behaviour
Docsify should work normally irrespective of CSP header.
Other relevant information
The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)
Please create a reproducible sandbox
I would but I am not sure how to simulate/modify HTTP headers in a sandbox!