Quill: Use of style attribute violates Content-Security-Policy inline style prevention.

[changelogsorg]

When using Content Security Policy restricting inline style modifications, the style will not be applied and Developer Tools will return a warning:

Refused to apply inline style because it violates the following Content Security Policy directive: (etc)

The line responsible:

var contents = this.clipboard.convert('<div class=\'ql-editor\' **style="white-space: normal;"**>' + html + '<p><br></p></div>');

Steps for Reproduction

1. Can't demonstrate it on something like Codepen, but this should do it:
   <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src https://cdn.quilljs.com; script-src 'self' https://cdn.quilljs.com;" />

1. Initialize as normal.

Expected behavior:
That is expected behaviour.

Actual behavior:
n/a

Platforms:
Chrome/Windows 10/Cross-platform.

Version:
1.2.6

[jhchen]

clipboard.convert is an internal method not meant for public consumption. The public interface for this functionality is dangerouslyPasteHTML, which allows arbitrary HTML input, and as its name suggests it may be dangerous and trip security warnings.

[GarrettGeorge]

This should be reopened, because even if it's not for public consumption, the function is still called which causes a CSP error.

[oliverniessen]

I'm running in the same problem with recent version of quill. Currently looking for a workaround or a solution. This should indeed be reopened.

[GarrettGeorge]

@oliverniessen Unfortunately the only workaround is to change the code yourself and use npm patch-package to have your changes checked into source control for your application. This also means that you'll have to include Quill into your build pipeline. With Webpack 4, you also get some reduced build size from this.