1012654 - [E.me] Remove inline style for CSP compliance

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Gaia::Everything.me, defect)

Description

[:gerard-majax]

Confere bug 968907 and bug 858787. We need to remove all CSS inline usage in certified apps.

https://github.com/mozilla-b2g/gaia/blob/master/apps/homescreen/everything.me/modules/BackgroundImage/BackgroundImage.js#L139

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

The Evme.$create function is also a problem:
https://github.com/mozilla-b2g/gaia/blob/master/apps/homescreen/everything.me/js/helpers/Utils.js#L1024

Where ever this is used to set a style attribute, this will fail.

Further more, it will also fail when used to create style elements, such as here:
https://github.com/mozilla-b2g/gaia/blob/master/apps/homescreen/everything.me/js/helpers/Utils.js#L1024

Comment 2

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

Ran (hello!), can you fix that if that's still relevant for the new homescreen ?

We would like to fix those things for 2.0. Basically in certified apps, we won't be able anymore to use <element style="some css rules"> directly. Instead we need to use the element.style.attribute = "something".

This is in order to enforce a strict csp policy for certified apps and reduce some security risks.

Comment 3

[Ran Ben Aharon [:ranbena] EverythingMe]

Vivien, this code isn't used in Home2. I'd rather not attend to it if it isn't relevant.

Comment 4

[Amir Nissim (:amirn)]

No longer relevant. EverythingMe was re-written for vertical homescreen.
Please reopen if needed.