CKEditor5 Violates Content Security Policy Due to Inline Styles

[arunkumar30]

📝 Provide detailed reproduction steps (if any)

Getting console error for CSP when below meta tags are included in html.
# <meta http-equiv="Content-Security-Policy" content="connect-src 'self'; script-src 'self'; style-src 'self'; " />

When trying to upload image, copy paste formatted text etc

• @ckeditor/ckeditor5-engine/src/dataprocessor/htmldataprocessor.js
• @ckeditor/ckeditor5-engine/src/view/domconverter.js
  

✔️ Expected result

No error should be there

❌ Actual result

error on console.

❓ Possible solution

Can we have flag to turn on / off csp. If CSP is turned on features that doesn't support CSP should not be active.

📃 Other details

• Browser: …
• OS: …
• First affected CKEditor version: …
• Installed CKEditor plugins: …
  [
  Alignment,
  Autoformat,
  BlockQuote,
  Bold,
  Copy,
  Cut,
  DefaultFont,
  Essentials,
  FindAndReplace,
  Font,
  FontBackgroundColor,
  FontColor,
  FontFamily,
  FontSize,
  FormatPainter,
  GeneralHtmlSupport,
  Heading,
  HorizontalLine,
  Image,
  ImageCaption,
  ImageInsert,
  ImageStyle,
  ImageUpload,
  Indent,
  IndentBlock,
  Italic,
  Link,
  List,
  Maximize,
  Paragraph,
  PasteBase64,
  PasteFromOffice,
  PasteFromOfficeEnhanced,
  PasteHandler,
  Paste,
  Preview,
  RemoveFormat,
  SelectAll,
  SpecialCharacters,
  SpecialCharactersArrows,
  SpecialCharactersCurrency,
  SpecialCharactersEssentials,
  SpecialCharactersLatin,
  SpecialCharactersMathematical,
  SpecialCharactersText,
  Strikethrough,
  Subscript,
  Superscript,
  Table,
  TableCellProperties,
  TableColumnResize,
  TableProperties,
  TableToolbar,
  TextTransformation,
  Underline
  ];

---

If you'd like to see this fixed sooner, add a 👍 reaction to this post.

[arunkumar30]

[Reinmar]

DUP of #15509

[arunkumar30]

@Reinmar It's not the issue with font plugin or text alignment. While am trying to upload image or copy paste the data CSP error is there.

In @ckeditor\ckeditor5-engine\src\view\domconverter.js , I can see setAttribute method which triggers the HTML parser and CSP error is thrown.

for setDomElementAttribute() function
domElement.setAttribute(shouldRenderAttribute ? key : UNSAFE_ATTRIBUTE_NAME_PREFIX + key, value);

[arunkumar30]

@Reinmar It seems wherever setAttribute has been used CSP violation is there. The issue is there for image upload , resize, font, when data is copied from any external source to editor and so on. Any workaround for the issue.