Intro.js: anchorLink.href violates unsafe-inline content security policy

[hakib]

The anchorLink.href is hard coded to 'javascript:void(0);'. This violates the unsafe-inline content security policy for the script-src directive. The violation does not effect the functionality in any way but it triggers a CSP report and that's usually reported back to the server (which cause a lot of unnecessary noise).

I think that this should be configurable for those who wish to enforce CSP.

[harunsmrkovic]

Also, just removing a href attribute from anchor works just fine. I can create a PR with this fix.

[afshinm]

@harunsmrkovic can you please?

[harunsmrkovic]

Here, hope it is good :) #568

[hakib]

Hey @harunsmrkovic, I just tested the PR on chrome and FF and it's no longer violates the unsafe-inline CSP policy. Thanks.