Skip to content

Inline script prevents strict CSP #13902

@alexkiro

Description

@alexkiro

Describe the bug

There is this single line of inline script that prevent a strict CSP from working:

<script>document.getElementById('searchbox').style.display = "block"</script>

<script>document.getElementById('searchbox').style.display = "block"</script>

Currently this cause the searchbox to not appear if a strict Content-Security-Policy is being used. It seems like it would be relatively easy to fix and pass more rigours security audits.

How to Reproduce

Any built-in sphinx template would have this (tested with classic and albatros)

Environment Information

Sphinx==8.2.3

Sphinx extensions

---

Additional context

There seems to be an old issue #3620 where CSP was resolved but this case may have been missed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions