Skip to content

Inline HTML styles conflict with Content Security Policy #99

Description

@Melebius
  • HtmlTestRunner version: 1.2.1
  • Python version: 3.8.10
  • Operating System: Ubuntu 20.04.6 LTS

Description

We use HtmlTestRunner for tests that are run on a Jenkins server. The HTML reports can be viewed in Jenkins but the stylesheets do not load, resulting in poorly rendered reports.

The Content Security Policy of Jenkins does not allow inline HTML styles. This can be worked around using the unsafe-inline keyword but the documentation recommends: “avoid using the unsafe-inline keyword in your CSP policy”.

I guess this could be solved with a CSP hash of the style if all the styles appearing in reports were defined in one <style> block and then referred to using attributes like class or id.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions