From 812e81e220acfbd2130fc04bb5a9bb1c14205526 Mon Sep 17 00:00:00 2001 From: mandalore Date: Thu, 6 Aug 2026 10:57:56 -0500 Subject: [PATCH] fix: allow inline styles in CSP so bar-chart widths actually apply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit style-src 'self' (without unsafe-inline) silently blocks style="..." attributes introduced via innerHTML — the CSS parses fine and the attribute is present in the DOM, but the browser never applies it, so every bar rendered at its track's full width regardless of its real percentage. script-src stays locked down; this only loosens CSS, and no untrusted external content is ever rendered into a style attribute here. Co-Authored-By: Claude Sonnet 5 --- scouting.gateway-gamers.net.conf | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/scouting.gateway-gamers.net.conf b/scouting.gateway-gamers.net.conf index 9f11a94..924daf5 100644 --- a/scouting.gateway-gamers.net.conf +++ b/scouting.gateway-gamers.net.conf @@ -28,7 +28,12 @@ server { add_header X-Frame-Options "SAMEORIGIN" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; - add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always; + # style-src needs 'unsafe-inline': the app sets bar-chart widths via + # inline style="width:X%" through innerHTML, which CSP's style-src + # blocks without it (script-src stays locked down — this only affects + # CSS, and nothing here renders untrusted external content into a + # style attribute). + add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://newprod-api.bestcoastpairings.com; img-src 'self' data:;" always; location / { try_files $uri $uri/ =404;