fix(views): render the dashboard without inline style attributes - #12
Merged
Conversation
A nonce cannot rescue an inline `style` attribute: those are governed by style-src-attr, which falls back to style-src, so under a strict `style-src 'self'` the table column widths collapsed and the queue depth bars disappeared. Column widths and the failed-jobs error cell move into role-named rules in input.css next to the other `table.fd-data` rules; the processes hostname cell drops a `font-size:12px` that `.dim` already set. The depth bar — the one dynamic width — becomes a server-rendered SVG like the adjacent sparkline, where `width` on a `<rect>` is a geometry attribute CSP never inspects. `test/integration/csp_inline_styles_test.rb` crawls every dashboard page, every jobs state, and both job detail paths, and fails on any rendered `style` attribute. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Captured with `rake screenshots` after the inline-style removal. The depth bars now come from the SVG partial; the rest of the diff is the seed data and relative timestamps re-rendering. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
styleattributes from the dashboard views. A nonce cannot rescue a style attribute — those are governed bystyle-src-attr, which falls back tostyle-src— so under a strictstyle-src 'self'the table column widths collapsed and the queue depth bars disappeared. This is the other half of the CSP work started in Emit csp-nonce meta tag so Turbo-injected styles/scripts work under a strict CSP #5.table.fd-datarules inassets-src/input.css(fd-col-select,fd-col-actions,-md,-lg,args.fd-error-cell), and drop thefont-size:12pxon the processes hostname cell thattable.fd-data .dimalready sets.metrics/_sparkline.html.erb:widthon a<rect>is a geometry attribute, so CSP never inspects it. Rounded ends come fromborder-radiuson the SVG root rather thanrx, whichpreserveAspectRatio="none"would stretch. Thefd-depth-barclass name is kept so the existing assertion inoverview_test.rbstill counts real bars.test/integration/csp_inline_styles_test.rb, which crawls the overview, queues, processes, recurring tasks,/flightdeck/jobsfor everyJobsQuery::STATESentry, and both a failed and a non-failed job detail page, failing on any renderedstyleattribute. A second test asserts the overview renders a depth bar with a non-zero width so the first cannot pass vacuously.flightdeck-ad6cd9e6c4b8.css→flightdeck-38ba36531cee.cssplusmanifest.json), add aCHANGELOG.mdline under[Unreleased], and regeneratedocs/screenshots. Most of the PNG diff is re-seeded data and relative timestamps rather than the style change.Testing
bin/test— 283 runs, 0 failures in both the full-host and API-only modes; assets freshbundle exec rake test:system— 13 runs, 48 assertions, 0 failuresbundle exec rubocop— 91 files inspected, no offensesbundle exec rake assets:check— assets are fresh (13 entries)bundle exec rake screenshots— all six PNGs regeneratedbin/demo: overview depth bars and every table's column widths, light and dark themes, at 1440px and ~1000px/flightdeck/recurring_tasks