Fix CSS injection for sites with strict CSP

This fix addresses an issue occurring on some pages where the response header includes `content-security-policy: require-trusted-types-for 'script'`.
obsproject · Aug 1, 2024 · 0607d8e · 0607d8e
1 parent d18fc7a
commit 0607d8e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/browser-client.cpp b/browser-client.cpp
@@ -679,8 +679,8 @@ void BrowserClient::OnLoadEnd(CefRefPtr<CefBrowser>, CefRefPtr<CefFrame> frame,
 
 		std::string script;
 		script += "const obsCSS = document.createElement('style');";
-		script += "obsCSS.innerHTML = decodeURIComponent(\"" +
-			  uriEncodedCSS + "\");";
+		script += "obsCSS.appendChild(document.createTextNode(decodeURIComponent(\"" +
+			  uriEncodedCSS + "\")));";
 		script += "document.querySelector('head').appendChild(obsCSS);";
 
 		frame->ExecuteJavaScript(script, "", 0);