Problem/Motivation

The current Tippy implementation requires 'unsafe-inline' to be set for the style-src directive when using a content security policy.

Steps to reproduce

Add the following CSP header.
default-src 'self'; script-src 'self' https://unpkg.com; frame-ancestors 'self';

Open a page where Tippy is used, for example /admin/structure/webform/config and notice that the Tippy styles are no longer included. This issue happens regardless of using the CDN or a locally installed library.

Proposed resolution

Tippy provides a solution for this issue by loading the javascript and stylesheet separately, ensuring that the styles don't have to be injected.

Issue fork webform-3246508

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Arkener created an issue. See original summary.

jrockowitz’s picture

jrockowitz commented

I think the answer is going to be to only support tippy 6.x and support CSP enabled.

With CSP enabled, you may need to separately link dist/tippy.css and use dist/tippy.umd.min.js instead.

jrockowitz’s picture

jrockowitz commented
Title: Tippy requires CSP 'unsafe-inline' » Only require Tippy 6.x with CSP enabled support

paulocs made their first commit to this issue’s fork.

paulocs’s picture

paulocs
Primary language Portuguese, Brazil
Location Belo Horizonte
commented
Status: Active » Needs review

paulocs opened merge request !74

paulocs’s picture

paulocs
Primary language Portuguese, Brazil
Location Belo Horizonte
commented
Parent issue: » #3249740: [META] Ensure webform compatibility with Drupal 9 only.
jrockowitz’s picture

jrockowitz commented
Title: Only require Tippy 6.x with CSP enabled support » [Drupal 9.x] Only require Tippy 6.x with CSP enabled support
jrockowitz’s picture

jrockowitz commented

This PR is looking pretty good. I still need to manually review it.

In Webform 6.2, we can change the tippy namespace from tippyjs/6.x to just tippyjs

jrockowitz’s picture

jrockowitz commented

This ticket got a little off track because are just removing 5.x and not addressing the CSP support.

For now lets keep focusing on removing 5.x support.

Steps to review

  • Checked out branch
  • Ran composer update (which is using composer merge) and confirm that web/libraries/tippyjs/5.x is deleted
  • Check the Status report (/admin/reports/status)
  • Check libraries configuration (/admin/structure/webform/config/libraries)
  • Check tooltips are working as expected in the admin UI

Changes

  • Removed "Tippy.js 6.x is compatible with Drupal 9.x." from notes

Notes

jrockowitz’s picture

jrockowitz commented

I posted Include /dist folder in release using GitHub build actions #1020, let's what happens.

jrockowitz’s picture

jrockowitz commented
Status: Needs review » Postponed
jrockowitz’s picture

jrockowitz commented
Title: [Drupal 9.x] Only require Tippy 6.x with CSP enabled support » [Drupal 9.x] Only require Tippy 6.x
Status: Postponed » Needs review
jrockowitz’s picture

jrockowitz commented

I created a new dedicated issues for #3255998: Enable CSP enabled support for Tippy.js

jrockowitz’s picture

jrockowitz commented
Status: Needs review » Reviewed & tested by the community

  • jrockowitz committed 7e4b640 on 6.2.x authored by paulocs 
    Issue #3246508 by jrockowitz, paulocs: [Drupal 9.x] Only require Tippy 6...
jrockowitz’s picture

jrockowitz commented
Version: 6.x-dev » 6.2.x-dev
jrockowitz’s picture

jrockowitz commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.