Is there a way to get Primefaces to add NONCE to more than one CSP directive

Viewed 470

I'm using Primefaces 8.0.7. My code use p:ajaxStatus:

<p:ajaxStatus class="25pix">
  <f:facet name="start">
    <p:graphicImage value="images/ajaxloadingbar.gif" />
  </f:facet>
  <f:facet name="complete">
    <h:outputText value="" />
  </f:facet>
</p:ajaxStatus>

However, at runtime, the f:facet element ends up with an inline style:

<td>
  <div id="j_idt26" class="25pix">
    <div id="j_idt26_start" style="display:none">
      <img id="j_idt27" src="images/ajaxloadingbar.gif?pfdrid_c=true" alt="" />
    </div>
    <div id="j_idt26_complete" style="display:none"></div>
  </div>
...

I have the CSP policy in my web.xml as:

<context-param>
    <param-name>primefaces.CSP_POLICY</param-name>
    <param-value>style-src 'self';img-src 'self';connect-src 'self';frame-src 'self';font-src 'self';media-src 'self';object-src 'self';manifest-src 'self';form-action 'self';frame
-ancestors 'self';script-src 'self'</param-value>
</context-param>

I understand that Primefaces inserts the nonce to the end of the policy, but that only takes care of the script-src. Is there a way I can get it to insert nonce on style-src too ? Or is there a way I can get f:facet NOT to use inline style?

Thanks.

0 Answers
Related