1412271 - createElementNS doesn't work with csp nonce

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[Vsevolod]

Attachment: nonce_error.html

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 YaBrowser/17.9.1.768 Yowser/2.5 Safari/537.36

Steps to reproduce:

create svg element with namespace document.createElementNS('http://www.w3.org/2000/svg', 'svg')
add some style (elem.style.position = 'absolute';)
add element to DOM (document.body.appendChild(elem);)

Link: http://vsesh.me/nonce_error.html


Actual results:

The SVG element added without style.
There is csp error in the console.


Expected results:

The SVG element must be added without errors.

Comment 1

[Daniel Veditz [:dveditz]]

Your CSP requires a nonce for both scripts and style. When you create the style element you need to add the nonce attribute to it.

Comment 2

[Vsevolod]

I didn't create a style element. I created style attribute. I works this createElement method. And it works in all another browsers.
Please, look at the example

Comment 3

[Daniel Veditz [:dveditz]]

Note: test document shows this works fine for a normal element, the failure is specifically with an element created in the SVG namespace. Possibly any namespaced element? Will have to test, but SVG for sure.