Fix CSP violations by replacing inline styles with CSS classes

src/Select2.php

@@ -319,11 +319,11 @@ protected function renderToggleAll()
             $accesskey = substr($this->accesskey, 0, 1);
             echo Html::tag('button', '', [
                 'accesskey' => $accesskey,
-                'style' => 'background: transparent;border: none !important;font-size:0;',
+                'class' => 's2-accesskey-btn',
                 'onfocus' => '$("#'.$this->options['id'].'").select2("open");',
             ]);
         }
-        echo Html::tag('span', $out, ['id' => 'parent-'.$options['id'], 'style' => 'display:none']);
+        echo Html::tag('span', $out, ['id' => 'parent-'.$options['id'], 'class' => 's2-togall-hidden']);
     }
 
     /**
@@ -399,11 +399,10 @@ protected function renderInput()
     {
         if ($this->pluginLoading) {
             $this->_loadIndicator = '<div class="kv-plugin-loading loading-'.$this->options['id'].'">&nbsp;</div>';
-            $opts = ['width' => '1px', 'height' => '1px', 'visibility' => 'hidden'];
+            Html::addCssClass($this->options, 's2-plugin-loading');
             if ($this->isBs(3)) {
-                $opts['width'] = '100%';
+                Html::addCssClass($this->options, 's2-plugin-loading-bs3');
             }
-            Html::addCssStyle($this->options, $opts);
         }
         Html::addCssClass($this->options, 'form-control');
         $input = $this->getInput('dropDownList', true);

src/assets/css/select2-addl.css

@@ -40,4 +40,25 @@
 .s2-togall-button .s2-select-label i,
 .s2-togall-button .s2-unselect-label i {
     margin: auto 0.25rem;
+}
+
+/* CSP-compliant classes to replace inline styles */
+.s2-plugin-loading {
+    width: 1px !important;
+    height: 1px !important;
+    visibility: hidden !important;
+}
+
+.s2-plugin-loading-bs3 {
+    width: 100% !important;
+}
+
+.s2-accesskey-btn {
+    background: transparent !important;
+    border: none !important;
+    font-size: 0 !important;
+}
+
+.s2-togall-hidden {
+    display: none !important;
 }