Content Security Policy (CSP) blocks application of inline styles

Type of bug

• Differences between Can I use & Modernizr
• False positive
• Modernizr error

Describe the bug Code within modernizr-2.8.3.js is being blocked by the Content Security Policy because it requires inline execution.

How to Reproduce

1. Apply the following Content-Security-Policy header for the site: content-security-policy: default-src 'self'; font-src 'self'; img-src 'self'; style-src 'self';
2. Open the site in Chrome (or browser of your choice)
3. Press 'F12' to open the Developers Console and view the Console
4. Refresh the site.
5. Observe errors in the Console.

Expected behavior modernizr functionality is not blocked by the Content Security Policy.

Additional context Unfortunately the use of a hash also requires the 'unsafe-inline' which does not prevent malicious inline code.