TYPO3 Core

can you check if this is still the case in latest versions, after changes of #93035

Still an issue with 10.4.16

To reproduce the issue best, upload it in fileadmin and click on "show" (error not as reliably reproducible when used in img-tag).

I've attached an svg-file for testing, it causes a CSP inline style error:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-sC0BVe7Sre2mjplSlS8Lw5K2vnLaWV+cQjtuz6e2u+Y='), or a nonce ('nonce-...') is required to enable inline execution.

Still an issue with TYPO3 v10.4.20

We have the same problem that our customers upload SVGs with inline styles and they are not allowed due to CSP rule.
We change the following code to allow inline styles for SVGs (complete file attached).

     <FilesMatch "\.pdf$">
         Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;" 
     </FilesMatch>
+    # matching requested *.svg files only (allow inline styles for SVGs)
+    <FilesMatch "\.svg$">
+        Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'unsafe-inline'; object-src 'none';" 
+    </FilesMatch>
     # matching anything else, using negative lookbehind pattern
-    <FilesMatch "(?<!\.pdf)$">
+    <FilesMatch "(?<!\.(pdf|svg))$">
         Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" 
     </FilesMatch>

Hope this helps! :)

Using directive style-src 'unsafe-inline' for .svg files seems to be fine (not talking about inline SVG embedded in HTML - which is totally different).

Attached test file svg-style.svg tries to load external CSS resources (e.g. used for IP sniffing, data-privacy related). CSP still should block these kind of requests.

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/75594

@Andreas Hager Thank you:)
I'm wondering why this hasn't been implemented in TYPO3 yet. Every TYPO3 system is affected by this when using SVGs.
Why is the review taking so long?

Applied in changeset 1e026a625eb1727f8d78573bb66462087392010d.

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/77456

Applied in changeset a0c0e57a7b264fe527aee74062af5d3dbb882c51.