Paper Elements use inline scripts => violate Chrome packaged app CSP rules

[anaisbetts]

Many Paper elements (paper-tabs at least) use inline Script tags which make them unusable in Chrome packaged apps. I'm coming from a non-web background so I have no idea what can be done about this, my apologies if this has been an already-filed issue (didn't see anything on search).

https://github.com/paulcbetts/chromeapp-materialdesign

[vikasprogrammer]

Use vulcanize to get rid of these CSP errors for now. But I am sure there is better solution.

[ragingwind]

If you want to use vulcanize. You can use grunt-vulcanize with Yeoman. Have look this sample https://github.com/chromist/chrome-app-codelab/blob/master/lab05-googledrive-gallery/Gruntfile.js#L328

[dfreedm]

Oh, you can use hash and nonce now? That might be interesting for vulcanize...

[anaisbetts]

@azakus I don't know that this error message is specific to Chrome Apps though, it also suggests to use unsafe-inline but that definitely doesn't work

[robdodson]

Keep an eye on this issue as well
https://github.com/Polymer/polymer-dev/issues/42

Known problem with noscript polymer elements, vulcanize, and chrome
packaged apps in M36+

On Tue, Jul 8, 2014 at 2:45 PM, Paul Betts [email protected] wrote:

@azakus https://github.com/azakus I don't know that this error message
is specific to Chrome Apps though, it also suggests to use unsafe-inline
but that definitely doesn't work

—
Reply to this email directly or view it on GitHub
#613 (comment).

[kevinpschaaf]

Closing, as vulcanize --csp is the supported solution for dealing with CSP environments.

https://github.com/Polymer/vulcanize/issues/37 is now resolved, which fixes a latent with Polymer still injecting inline scripts for noscript elements even when vulcanize --csp'ed.

[anaisbetts]

In case anyone stumbles upon this bug in the future, https://github.com/PolymerLabs/polymerchromeapp is a great "Getting Started" for using Paper Elements in Chrome packaged apps