mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
evangelostsak
9261ac9b01
The previous reason named only multi edit, which made the relaxation look specific to one tool and newly needed. Neither is true. LAM emits inline <script> elements through htmlJavaScript from 18 shipped files, covering two-factor setup, deletion, tree view, mass upload, PDF editing, several account modules and the config pages. Every one was blocked before; nothing had driven those paths until a test used multi edit. Hashing was evaluated and does not work here. A directive carrying any hash makes browsers ignore unsafe-inline entirely, so all 18 sites would have to be enumerated, and several build their snippet per request.
10 lines
843 B
YAML
10 lines
843 B
YAML
---
|
|
flags:
|
|
style-src-attr:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
script-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: LAM emits inline <script> elements from 18 files (htmlJavaScript in lib/html.inc), so this was always required and only surfaced when a test first drove multi edit; hashing is not an option because one hash makes browsers ignore unsafe-inline for the whole directive and the dynamic snippets cannot be hashed
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
script-src-attr:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|