extract ErrorBoundary style

[AlexErrant]

PR Checklist

Please check if your PR fulfills the following requirements:

• Tests for the changes have been added (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Other... Please describe: Security improvement

What is the current behavior?

Inline styles are an attack vector 1, 2. They may be prevented with the Content Security Policy style-src 'self'; as recommended by OWASP.

What is the new behavior?

This PR moves the inline style out to a stylesheet so users can use style-src 'self';.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 213df30

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in Stackblitz

More templates

• example-bare
• example-basic
• example-experiments
• example-hackernews
• example-notes
• example-todomvc
• example-with-auth
• example-with-authjs
• example-with-drizzle
• example-with-mdx
• example-with-solid-styled
• example-with-prisma
• example-with-trpc
• example-with-tailwindcss
• example-with-vitest
• example-with-unocss

pnpm add https://pkg.pr.new/@solidjs/start@1609

commit: 213df30

[ryansolid]

If I understanding the issue: With this setting turned on inline styles are completely disabled. What we are doing here is not a security vulnerability because we aren't using CSS variables. But if one would want to protect against a potential security vulnerability they would want to enable this setting to disable inline styles.

Did you check that it works? I'm not seeing the CSS file being included anywhere.

[AlexErrant]

Did you check that it works?

...nope 🤦‍♂️

Upon checking, I realized that the dev-overlay, specifically shikiji, also uses inline styles, so this PR would not ultimately fix the problem.

A future possibility could be to put the dev-overlay in an iframe... I think that might isolate it from a Content-Security-Policy of style-src 'self';. However I'm not sure how to load Solid into something an iframe can host, so I'm closing.

we aren't using CSS variables

Ah, one of my OP's links was misleading; I removed it. CSS variables are not relevant to this issue.