-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove unsafe inline in CSP policy and update svg fill #1349
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SVGs are displayed great for me 👍
Co-authored-by: rmccar <[email protected]>
Quick follow-up question from this for @VirajP1002 & @rmccar - were you testing this locally? I tested locally but the images seemed to be aligned for that schema. Were you testing in a staging/test env instead? I just wanted to double-check what I should be looking for next time 👀 |
I was just testing locally, try checking out the commit before the last one and launching the test_theme_ukhsa_ons schema. Thats all I did, maybe you missed it? Then check out the latest one and they should be aligned |
Ah, ignore me, I just double-checked in staging - I didn't realise that the bottom SVG always needs to look indented from the top SVG. I think I saw them both aligned locally and thought that was the expected layout. Thanks for your help 👍 |
Nah its wrong in main too, they're both supposed to be next to each other but yeah sounds like you're seeing the right thing. If you check this branch out now you should see them how they're supposed to be |
Yep looks all good now, thanks 👍 |
I've also tested this in my staging and looking good so will merge it now. |
What is the context of this PR?
This removes unsafe-inline from CSP policy, removes inline CSS "fill" from our SVG components and adds svg native fill property to these. One unit test had to be amended. Some of our SVGs (Logos) use inline styles for colour fills, however these do not work without explicitly allowing the unsafe-inline CSP policy which is considered unsafe. We needed to get the SVGs updated to not use CSS.
How to review
Visually check SVG logos in different "test_theme_" schemas, check if svg components are looking the same after the change.
Checklist