Inline javascript event handlers interfere with CSP

[smeedijzer]

When will Gravity Forms remove Inline javascript event handlers?

Inline javascript event handles interfere with CSP

@crawford In short: no there’s no way (without using other plugins/code that filter inline JS). I asked the same question to support a while ago and submitted it to the roadmap page (but not added to the list by GF). It seems this security issue has no priority at all… Here the conversation: Me: Gravity Forms adds inline scripts to e.g. the submit button (see below). This makes it impossible to set a Content Security Policy without ‘unsafe-inline’. What can I do to use GF with a CSP withou…

[smeedijzer]

Can anyone from the support team please clarify on this matter?

[chrishajer (Chris (Gravity Forms))]

Please contact support so your issue can be addressed appropriately.

https://www.gravityforms.com/open-support-ticket/technical/

Thank you.

[smeedijzer]

I did this earlier (Inline javascript event handles interfere with CSP - #3 by smeedijzer). My simple question is: will Gravity Forms remove the Inline javascript event handlers and when?

[chrishajer (Chris (Gravity Forms))]

Hello. We do not have a timeline for that. Thank you.

[smeedijzer]

Thank you for your reply.

Gravity Forms should refactor inline event handlers to reduce XSS risk. I hope this will get on the roadmap soon.