[
https://issues.apache.org/jira/browse/TOBAGO-1777?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Udo Schnurpfeil resolved TOBAGO-1777.
-------------------------------------
Resolution: Fixed
> Improve CSS Style rendering
> ---------------------------
>
> Key: TOBAGO-1777
> URL: https://issues.apache.org/jira/browse/TOBAGO-1777
> Project: MyFaces Tobago
> Issue Type: Improvement
> Reporter: Udo Schnurpfeil
> Assignee: Udo Schnurpfeil
> Fix For: 4.0.0
>
>
> Drop "data-tobago-style" attribute. With CSP Level 2 it's possible, to put
> individual CSS inside the page marked with a nonce. So we'll get rid of the
> JavaScript data-attribute solution.
> That might render faster and might be more secure (an attacker may currently
> include a data-tobago-style attribute). That's not a big problem, because the
> JavaScript only supports a limited subset of CSS.
> Current todos:
> * Collect Styles and render at the end of the body (/)
> * Write a nonce on the styles and set the HTTP CSP Level 2 header (/)
> * AJAX support (/)
> * Test: backgroundImage (x)
> * new util RandomUtils for the nonce (which is the same like in the class
> Secret, see TOBAGO-1787) (/)
> * Simplify some renderers (/)
> * Simplify IconEncoder concept (TOBAGO-1778)
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
