rails/rails — pull request #11407 by rbhitchcock (2013-07-12 03:55:43+00:00)
Title: Update the form_tag helper to comply with CSP

[Content Security Policy](http://www.w3.org/TR/CSP/) by default does not allow for inline style attributes in HTML tags. The ```form_for``` and ```form_tag``` actionview helpers, when adding hidden input fields (such as the one containing the CSRF token) to the generated form, create a ```div``` tag that has some inline style rules applied.

```html

```
In order to comply with CSP, this ```style``` attribute should be removed and replaced with a class (if it is desired that the style attributes continue to be applied).

```html

```

```css
/* Stylesheet definition */
form div.extra_tags {
padding: 0;
margin: 0;
display: inline;
}
```
If this change is not made, any developers who wish to return the Content Security Policy header for their application will have to:

1) Patch their install of rails to not use an inline style attribute with this helper
2) Not use the form helpers
3) Define their CSP directive to allow inline style attributes (not ideal or secure)

Hopefully the class name is descriptive enough. First pull request... tried to follow the instructions in the contribution guide. Apologies in advance for anything I overlooked. Thanks!