Skip to content

The Sortable cursor option applies inline styles violating CSP #8066

@IvanDanchev

Description

@IvanDanchev

Describe the bug
Setting the Sortable "cursor" option results in inline styles being applied through the _setCursor function in kendo.all.min.js. This causes a CSP related js exception.

To reproduce

  1. On a page with strict Content-Security-Policy enabled, drag and drop an item using the example below:
<ul id="sortable">
    <li>ItemA1</li>
    <li>ItemA2</li>
    <li>ItemA3</li>
</ul>

<script>
    $("#sortable").kendoSortable({
        cursor: "move"
    });
</script>

Expected behavior
No inline styles should be added, to ensure CSP compatibility.

Actual behavior
A js error related to inline styles is thrown.

Affected browsers (please remove the unneeded items)

  • All

Product Version
2024.4.1112

Metadata

Metadata

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions