Solved CSP bugs for echoserver

filter_plugins/csp_filters.py

@@ -128,7 +128,7 @@ class FilterModule(object):
                 ):
                     domain = domains.get('portfolio')[0]
                     sld_tld = ".".join(domain.split(".")[-2:])  # yields "example.com"
-                    tokens.append(f"{sld_tld}")               # yields "*.example.com"
+                    tokens.append(f"{sld_tld}")                 # yields "*.example.com"
 
                 # whitelist
                 tokens += self.get_csp_whitelist(applications, application_id, directive)

roles/docker-espocrm/vars/configuration.yml

@@ -20,6 +20,8 @@ csp:
       unsafe-eval:    true
     style-src:
       unsafe-inline:  true
+    script-src:
+      unsafe-eval:    true
   whitelist:
     connect-src:
       - wss://espocrm.{{ primary_domain }}

roles/docker-matomo/vars/configuration.yml

@@ -13,11 +13,14 @@ csp:
     style-src:
       - https://fonts.googleapis.com
   flags:
+    script-src:
+      unsafe-eval:   true
     script-src-elem:
       unsafe-inline: true
       unsafe-eval:   true
     style-src:
       unsafe-inline: true
+      unsafe-eval:   true
 domains:
   aliases:
     - "analytics.{{ primary_domain }}"

roles/docker-openproject/vars/configuration.yml

@@ -8,7 +8,7 @@ ldap:
     users:            False   # Set true to filter users
 features:
   matomo:             true
-  css:                true
+  css:                false   # Temporary deactivated. Needs to be optimized for production use.
   portfolio_iframe:   false
   ldap:               true
   central_database:   true

roles/docker-peertube/vars/configuration.yml

@@ -9,6 +9,8 @@ csp:
   flags:
     script-src-elem:
       unsafe-inline:  true
+    script-src:
+      unsafe-inline:  true
     style-src:
       unsafe-inline:  true
   whitelist:

roles/docker-sphinx/vars/configuration.yml

@@ -4,6 +4,8 @@ features:
   portfolio_iframe:   false
 csp:
   flags:
+    script-src:
+      unsafe-eval:    true
     script-src-elem:
       unsafe-inline:  true
       unsafe-eval:    true

roles/nginx-modifier-matomo/tasks/main.yml

@@ -77,7 +77,7 @@
             (application_id): {
               'csp': {
                 'hashes': {
-                  'script-src': (
+                  'script-src-elem': (
                     applications[application_id]['csp']['hashes'].get('script-src', [])
                     + [ matomo_tracking_code_one_liner ]
                   )