[Bug]: use of `setAttribute('style', ...)` in `rrweb/src/record/mutation.ts` violates CSP `style-src` directive

[gestureleft]

Preflight Checklist

• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

What package is this bug report for?

rrweb

Version

2.6.0

Expected Behavior

I would expect that even with a strict CSP policy (e.g. style-src 'nonce-${SOME_NONCE}), I would still be able to successfully capture replays. (See a similar issue in a different package)

Actual Behavior

A CSP error occurs due to use of setAttribute('style', ...) here

Steps to Reproduce

• Set up a vue project that uses Sentry with replays enabled and a strict CSP policy (e.g. style-src 'nonce-${SOME_NONCE})
• Write a basic component that uses `:style="{ 'background-color': someDynamicVariable }"
• Deploy the application, trigger an error so a replay begins and update someDynamicVariable - observe how a CSP error occurs

Testcase Gist URL

No response

Additional Information

There might be a simpler way to reproduce the issue, but I've described the setup we observed the issue in. Without any knowledge of what the culprit code is actually trying to do, its hard for me to provide a more concise reproduction.

[IanVS]

I'm also seeing tons of CSP errors due to this. I'm considering removing sentry to avoid the errors. Or at least disabling replay, which is where they seem to be originating.

[mydea]

Hello,

this is sadly a known issue and tracked here: getsentry/sentry-javascript#10481

It's something we would like to fix but the fix is sadly not trivial at all, so it is not clear when we will get around to it.

cc @billyvg not sure if you have time to look into this in the near future, I think @chargome is pretty booked out right now 😬