react-uswds
react-uswds copied to clipboard
[fix] Inline SVGs and Content Security Policy support
ReactUSWDS Version & USWDS Version:
ReactUSWDS: 2.9.0 USWDS: 2.11.2
Describe the bug
After implementing Content-Security-Policy-Report-Only
with an img-src: 'self' <our whitelisted domains>;
directive, we are seeing reports of inline images coming from react-uswds.
To Reproduce Steps to reproduce the behavior:
- Implement a CSP policy containing at least
img-src: 'self'
- Add code using GovBanner
- Load page and see reports of unsafe inline images
Expected behavior
A way to avoid bundling these SVGs and thus implement a strict CSP.
Screenshots
Additional context
Device and Browser Information (please complete the following information if describing a UI bug):
- Firefox 103