fix: replace inline event handlers with addEventListener to comply wi…

[Jerricho93]

Closes #1341

The error dialog's <media-theme> element used inline onclose and onfocusin attributes, which violate a strict script-src CSP (no 'unsafe-inline', and no script-src-attr override). Unlike the retry link (fixed in #1332), these are not gated on user interaction; they fire on the dialog's own focus/lifecycle events, so they trip CSP essentially whenever an error dialog appears.

Although the player's html template processor rebinds on* values via addEventListener and strips the attribute at runtime, the literal on*= text still lives in the template HTML string that is parsed/cloned into the live DOM. The browser therefore attempts to compile the inline handler (and CSP refuses it, reporting violated-directive: script-src-attr, blocked-uri: inline) before the processor removes the attribute.

Changes

• mux-player: Removes the onclose/onfocusin attributes from the <media-theme> template. The two handlers are now bound programmatically on the media-theme element via addEventListener in #setUpErrors, with matching cleanup in disconnectedCallback. The handlers keep their existing composedPath() / media-error-dialog guards, so behavior is unchanged.
• Removes the now-unused onCloseErrorDialog / onFocusInErrorDialog template props from MuxTemplateProps.
• test: Adds a template.test.js regression test asserting the rendered template contains no inline on* event-handler attributes. It checks the raw template string (pre part-processing), since that is what the browser parses into the DOM and what CSP evaluates (the post-render DOM would hide the regression because the processor strips the attributes).

Testing

• npm test in packages/mux-player — 134 passing, 0 failed.
• Existing error-dialog open/close tests (player.test.js) continue to pass, confirming the rebound close/focusin handlers behave identically.
• Static check: grep -oE '\bon[a-z]+="[^"]*"' dist/mux-player.mjs returns no error-dialog handlers after build.

Notes

• This is a follow-up to fix: remove inline onclick CSP violation in retry link #1332, which removed the inline onclick from the retry link. Together they clear all inline event-handler attributes from the error-dialog path so consumers (e.g. the player.mux.com iframe embed) can enforce a strict script-src without 'unsafe-inline'.
• No reliance on 'unsafe-inline' is introduced; the fix is purely addEventListener-based.

---

Note

Low Risk
Small, localized wiring change with existing tests and a CSP regression guard; no auth or data-path changes.

Overview
Removes inline onclose / onfocusin from the <media-theme> template so strict script-src (no 'unsafe-inline') no longer trips script-src-attr when the error dialog appears. The browser evaluates inline handlers in the parsed template string before the html processor can strip them.

Error-dialog close and focus behavior is unchanged: #onCloseErrorDialog and #onFocusInErrorDialog are class fields with the same composedPath() / media-error-dialog guards, wired in #setUpErrors with addEventListener('close'|'focusin') on mediaTheme and removed in disconnectedCallback. The corresponding props are dropped from MuxTemplateProps.

Adds a regression test that the raw template HTML (pre part-processing) contains no on* event-handler attributes, since post-render DOM would hide a reintroduction.

^{Reviewed by Cursor Bugbot for commit 0dbffa3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

@Jerricho93 is attempting to deploy a commit to the Mux Team on Vercel.

A member of the Team first needs to authorize it.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
elements-demo-astro	Ready	Preview, Comment	Jul 14, 2026 8:54pm
elements-demo-nextjs	Ready	Preview, Comment	Jul 14, 2026 8:54pm
elements-demo-svelte-kit	Ready	Preview, Comment	Jul 14, 2026 8:54pm
elements-demo-vanilla	Ready	Preview, Comment	Jul 14, 2026 8:54pm
elements-demo-vue	Ready	Preview, Comment	Jul 14, 2026 8:54pm