mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
d721e887a5
The dashboard sent script-src 'unsafe-inline' from two sources. Its own meta/csp.yml granted it to script-src-attr, and build_csp_header adds it to script-src-elem and script-src-attr for every app with services.logout.enabled. Both reach script-src through the family union, and the token in script-src-elem also closes the hash gate, so the hashes that sys-front-inj-javascript, -dashboard, -logout and -matomo register for their inline snippets were discarded. build_csp_header now skips the logout grant on a directive whose meta/csp.yml sets unsafe-inline: false. Only web-app-dashboard sets it: on script-src and script-src-elem. Its injected snippets now run by hash and the logout one-liner is hashed like the others. A render of build_csp_header for every role, variant, logout on/off and tor on/off (1712 headers) differs from origin/main only in the 8 web-app-dashboard headers; the 86 other roles that declare a logout service render byte-identical policies. script-src-attr keeps 'unsafe-inline': port-ui 2.2.2 still renders inline event handlers (menu onclick entries, openDynamicPopup, closeAllModals, the card image onerror). It goes once the port-ui release without inline handlers is pinned and header.yml.j2 moves from onclick to action. The dashboard Playwright spec asserts that script-src and script-src-elem carry no 'unsafe-inline' on the landing page, next to its existing check for CSP violations. Refs #1122 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
1.3 KiB
YAML
24 lines
1.3 KiB
YAML
---
|
|
whitelist:
|
|
script-src-elem:
|
|
- "{{ lookup('asset_host') }}"
|
|
- https://kit.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
- https://code.jquery.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
style-src-elem:
|
|
- https://kit.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
- https://code.jquery.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
font-src:
|
|
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
connect-src:
|
|
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
- "{{ lookup('domain', 'web-app-keycloak') }}"
|
|
frame-src:
|
|
- "*.{{ DOMAIN_PRIMARY }}"
|
|
flags:
|
|
script-src:
|
|
unsafe-inline: false
|
|
script-src-elem:
|
|
unsafe-inline: false
|
|
script-src-attr:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: port-ui 2.2.2 renders inline event handlers (menu onclick entries, openDynamicPopup, closeAllModals, card image onerror)
|