I'm using Primefaces 8.0.7. My code use p:ajaxStatus:
<p:ajaxStatus class="25pix">
<f:facet name="start">
<p:graphicImage value="images/ajaxloadingbar.gif" />
</f:facet>
<f:facet name="complete">
<h:outputText value="" />
</f:facet>
</p:ajaxStatus>
However, at runtime, the f:facet element ends up with an inline style:
<td>
<div id="j_idt26" class="25pix">
<div id="j_idt26_start" style="display:none">
<img id="j_idt27" src="images/ajaxloadingbar.gif?pfdrid_c=true" alt="" />
</div>
<div id="j_idt26_complete" style="display:none"></div>
</div>
...
I have the CSP policy in my web.xml as:
<context-param>
<param-name>primefaces.CSP_POLICY</param-name>
<param-value>style-src 'self';img-src 'self';connect-src 'self';frame-src 'self';font-src 'self';media-src 'self';object-src 'self';manifest-src 'self';form-action 'self';frame
-ancestors 'self';script-src 'self'</param-value>
</context-param>
I understand that Primefaces inserts the nonce to the end of the policy, but that only takes care of the script-src. Is there a way I can get it to insert nonce on style-src too ? Or is there a way I can get f:facet NOT to use inline style?
Thanks.