CSP for dynamically loaded CSS

Question

So I'm loading a JavaScript file from a third party into my application which injects an iframe onto the page. When that iframe loads, it loads its own JavaScript which creates an inline style tag in the parent window.

Because of this flow, I have to have "unsafe-inline" in my content security policy for the style-src directive. Is there anything like strict-dynamic that would work for styles loaded like this? Or is there some kind of solution in which I don't have to have "unsafe-inline" listed in my CSP that still allows this one stylesheet?

Best I can come up with is to scan this redirected file every couple of hours and generate subresource integrity hashes for it to inject into my CSP on a regular basis, but this seems really fragile.

Answer 1

Setting CSS via the CSS Object Model (CSSOM) works with CSP. Thus:

document.getElementById(id).style.left = '343px';

In this case you may have to convince the 3rd party vendor to alter their JavaScript.

source: https://stackoverflow.com/a/29089970/339440