BPMN viewer conflicts with strict Content-Security-Policy (CSP) style-src directive

[andyflatwhite]

Describe the Bug

Steps to Reproduce

1. Run the BPMN viewer within a web application which has strict style-src directives in its Content Security Policy (CSP) header

Expected Behavior

Style manipulations should be performed in a way which does not break CSP rules.

More Information

See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src

the following stylesheets are blocked and won't load [...] Inline style attributes are also blocked [...] As well as styles that are applied in JavaScript by setting the style attribute directly, or by setting cssText

The problematic parts of the BPMN code relate to uses of the domify helper. When used with inline styles, a strict style-src directive will block the styles from taking effect. The styles should be set directly on the element's style property, as shown in the above MDN link.

Environment

• Browser: Any of these: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#browser_compatibility
• OS: Any
• Library version: 6.0.0 and up

---

Also reported via internal conversation.

[nikku]

We'd need to decide on a scope (viewer only? navigate viewer?) if we wanted to fix this.

I.e. in our modeler distribution there is a larger number of that disallowed by CSP usages (search for assign\([^.\n]+\.style regex).

[andyflatwhite]

Thanks @nikku. I don't think I'm best placed to figure out all the packages that might include this issue, but if I could have some help identifying them I'd be happy to create new PRs to include similar fixes. Your link to the modeler distribution shows this is present in other places, but from that I'm not sure where the fix would be applied (although if it's in the same repo I can have another look to see if there are things I might have missed).

I've seen your suggestion in the PR I created and I'll get that actioned soon.

[barmac]

Closed via #1645

[andyflatwhite]

🎉 Thanks all!