{"action":"created","issue":{"url":"https://api.github.com/repos/braintree/braintree-web/issues/53","labels_url":"https://api.github.com/repos/braintree/braintree-web/issues/53/labels{/name}","comments_url":"https://api.github.com/repos/braintree/braintree-web/issues/53/comments","events_url":"https://api.github.com/repos/braintree/braintree-web/issues/53/events","html_url":"https://github.com/braintree/braintree-web/issues/53","id":89081844,"number":53,"title":"Braintree-Data.js is not working with Content-Security-Policy","user":{"login":"le0pard","id":98444,"avatar_url":"https://avatars.githubusercontent.com/u/98444?v=3","gravatar_id":"","url":"https://api.github.com/users/le0pard","html_url":"https://github.com/le0pard","followers_url":"https://api.github.com/users/le0pard/followers","following_url":"https://api.github.com/users/le0pard/following{/other_user}","gists_url":"https://api.github.com/users/le0pard/gists{/gist_id}","starred_url":"https://api.github.com/users/le0pard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/le0pard/subscriptions","organizations_url":"https://api.github.com/users/le0pard/orgs","repos_url":"https://api.github.com/users/le0pard/repos","events_url":"https://api.github.com/users/le0pard/events{/privacy}","received_events_url":"https://api.github.com/users/le0pard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-06-17T17:52:55Z","updated_at":"2015-08-13T16:13:42Z","closed_at":null,"body":"Hello.\r\n\r\nMy name is Alexey. I am using Braintree for one of our product. Right now I trying to add “Content-Security-Policy”, because we show HTML emails for users and need to block js code execution (eval and inline js). After set header “Content-Security-Policy” I found, what braintree-data.js (https://developers.braintreepayments.com/javascript+ruby/guides/advanced-fraud-tools/client-side) is cause errors:\r\n\r\n“Refused to execute JavaScript URL because it violates the following Content Security Policy directive: \"script-src *.uservoice.com *.google-analytics.com widget.intercom.io js.intercomcdn.com *.braintreegateway.com *.sandbox.braintreegateway.com *.paypalobjects.com\". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.”\r\n\r\n![123](https://cloud.githubusercontent.com/assets/98444/8214602/f466af1c-1532-11e5-9382-40d1f1951a5b.png)\r\n\r\nFirst error because of this line of code: `iframe.src='javascript:false’;`. This can be fixed by `iframe.src='about:blank';`.\r\n\r\nNext error go from this line of code: `doc.write('<body onload=\"document._l();\">');`. document.write should be disabled for good Content Security Policy http://www.cspplayground.com/compliant_examples#eval This can be fixed by an replace `doc.addEventListener('DOMContentLoaded',function(){doc._l();});`.\r\n\r\nBut even after this changes I couldn't use `braintree-data.js`, because it load \"https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.pp.min.js\" which have similar problems inside. Of course, I can fix even this script and change url in `braintree-data.js`, but I just want, what this will work without `'unsafe-inline' 'unsafe-eval'` for http://content-security-policy.com/. \r\n\r\nDo you have some version, which works with \"Content-Security-Policy”? How can I send PR for this lib (2 js libs, as I understand)?"},"comment":{"url":"https://api.github.com/repos/braintree/braintree-web/issues/comments/130745901","html_url":"https://github.com/braintree/braintree-web/issues/53#issuecomment-130745901","issue_url":"https://api.github.com/repos/braintree/braintree-web/issues/53","id":130745901,"user":{"login":"le0pard","id":98444,"avatar_url":"https://avatars.githubusercontent.com/u/98444?v=3","gravatar_id":"","url":"https://api.github.com/users/le0pard","html_url":"https://github.com/le0pard","followers_url":"https://api.github.com/users/le0pard/followers","following_url":"https://api.github.com/users/le0pard/following{/other_user}","gists_url":"https://api.github.com/users/le0pard/gists{/gist_id}","starred_url":"https://api.github.com/users/le0pard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/le0pard/subscriptions","organizations_url":"https://api.github.com/users/le0pard/orgs","repos_url":"https://api.github.com/users/le0pard/repos","events_url":"https://api.github.com/users/le0pard/events{/privacy}","received_events_url":"https://api.github.com/users/le0pard/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T16:13:42Z","updated_at":"2015-08-13T16:13:42Z","body":"Ping. Still waiting for fix. Maybe I can help in some way? If library will be in open-source - I can make PR to it."}}