Skip to content

Commit 2fb6514

Browse files
committed
Fix CSP violations - use CSS classes instead of inline styles
CSP with nonce blocks all inline style attributes and JS element.style modifications. Replace inline style="width: X%" with CSS classes (progress-w-15, progress-w-30, etc.) and use class swapping in the Stimulus controller.
1 parent c0ae94a commit 2fb6514

File tree

2 files changed

+22
-11
lines changed

2 files changed

+22
-11
lines changed

assets/controllers/docker_update_progress_controller.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -342,17 +342,20 @@ export default class extends Controller {
342342

343343
updateProgressBar(percent) {
344344
if (this.hasProgressBarTarget) {
345-
this.progressBarTarget.style.width = percent + '%';
346-
this.progressBarTarget.textContent = percent + '%';
347-
this.progressBarTarget.setAttribute('aria-valuenow', percent);
348-
349-
this.progressBarTarget.classList.remove('bg-success', 'bg-danger', 'progress-bar-striped', 'progress-bar-animated');
345+
const bar = this.progressBarTarget;
346+
// Remove all width classes
347+
bar.classList.remove('progress-w-0', 'progress-w-15', 'progress-w-30', 'progress-w-50', 'progress-w-65', 'progress-w-80', 'progress-w-100');
348+
bar.classList.add('progress-w-' + percent);
349+
bar.textContent = percent + '%';
350+
bar.setAttribute('aria-valuenow', percent);
351+
352+
bar.classList.remove('bg-success', 'bg-danger', 'progress-bar-striped', 'progress-bar-animated');
350353
if (percent === 100) {
351-
this.progressBarTarget.classList.add('bg-success');
354+
bar.classList.add('bg-success');
352355
} else if (percent === 0) {
353-
this.progressBarTarget.classList.add('bg-danger');
356+
bar.classList.add('bg-danger');
354357
} else {
355-
this.progressBarTarget.classList.add('progress-bar-striped', 'progress-bar-animated');
358+
bar.classList.add('progress-bar-striped', 'progress-bar-animated');
356359
}
357360
}
358361
}

templates/admin/update_manager/docker_progress.html.twig

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,15 @@
5151
100% { opacity: 0.3; }
5252
}
5353
.step-timestamp { min-width: 60px; text-align: right; }
54+
/* Progress bar widths - CSS classes to avoid CSP inline style violations */
55+
.docker-progress { height: 25px; }
56+
.progress-w-0 { width: 0%; }
57+
.progress-w-15 { width: 15%; }
58+
.progress-w-30 { width: 30%; }
59+
.progress-w-50 { width: 50%; }
60+
.progress-w-65 { width: 65%; }
61+
.progress-w-80 { width: 80%; }
62+
.progress-w-100 { width: 100%; }
5463
</style>
5564
<div data-controller="docker-update-progress"
5665
data-docker-update-progress-health-url-value="{{ path('admin_update_manager_health') }}"
@@ -87,10 +96,9 @@
8796
</div>
8897

8998
{# Progress Bar #}
90-
<div class="progress mb-4" style="height: 25px;">
91-
<div class="progress-bar progress-bar-striped progress-bar-animated"
99+
<div class="progress mb-4 docker-progress">
100+
<div class="progress-bar progress-bar-striped progress-bar-animated progress-w-15"
92101
role="progressbar"
93-
style="width: 15%"
94102
aria-valuenow="15"
95103
aria-valuemin="0"
96104
aria-valuemax="100"

0 commit comments

Comments
 (0)