setting cssText rather than style

[johanneswilm]

Aftr reading through the discussion on #212, it's still unclear to me why a CSP policy of style-src-attr 'self' will disallow:

dom.setAttribute("style", "background-color: blue;")

but not:

dom.style.cssText = "background-color: blue;"

Why is it safer to set the cssText rather than the style attribute?

[mxxk]

Like @johanneswilm pointed out, assignment of inline CSS via cssText and setAttribute triggers CSS parsing, much like <span style="...">. I would likewise expect all three cases to fail in the presence of style-src-attr 'self'.

Furthermore, it looks like the CSP specification specifically calls out that assignment via cssText should require style-src-attr 'unsafe-inline':

4. The following CSS algorithms are gated on the unsafe-eval source expression:

   1. insert a CSS rule

   2. parse a CSS rule,

   3. parse a CSS declaration block

   4. parse a group of selectors

This would include, for example, all invocations of CSSOM’s various cssText setters and insertRule methods [CSSOM] [HTML].

Based on this, it would seem that if a browser allows assignment via cssText without style-src-attr 'unsafe-inline', it is in violation of the specification.

[johanneswilm]

Right, but this is the case in the two main browsers and has been for years, so there will be lots of code in the wild making use of this, so it probably cannot be changed at this stage without breaking client side code.
I wonder if there is any point in keeping the style-src-attr CSP rule if there is an easy workaround like this. What is the advantage of having it?