Content Security Policy violation in kendo-drawing package

1 Answer 61 Views
Charts Drawing Security
Jason
Top achievements
Rank 1
Jason asked on 09 Jan 2023, 03:07 PM

I'm attempting to use kendo-charts but when applying a strict content security policy there are many CSP violations regarding style-src.

This appears to be related to the file render-svg.js, in particular the attempt to set innerHTML:

var renderSVG = function(container, svg) {
    container.innerHTML = svg;
};

Is there any way to avoid this? We cannot set 'unsafe-inline' for the entire application.

Thanks.

1 Answer, 1 is accepted

Sort by
0
Filip
Telerik team
answered on 11 Jan 2023, 07:58 AM

Hello, Jason,

Thank you for reaching out to us.

We reached out to the development team and it seems that we have fixed this issue,  once the new version is released next week (on the 18th of January) this issue will be resolved.

I hope this helps.

Regards,
Filip
Progress Telerik

Virtual Classroom, the free self-paced technical training that gets you up to speed with Telerik and Kendo UI products quickly just got a fresh new look + new and improved content including a brand new Blazor course! Check it out at https://learn.telerik.com/.

Tags
Charts Drawing Security
Asked by
Jason
Top achievements
Rank 1
Answers by
Filip
Telerik team
Share this question
or