mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a17ea27a6b
Matomo 5.14.0 renders the "What's new" entry of its top bar, once for the
desktop menu and once for the mobile one, as <a onclick=... href="javascript:">
(plugins/CoreAdminHome/Menu.php). Without the logout service, script-src-attr
carries only 'self' 'unsafe-eval', so the browser blocks both handlers.
Playwright 1.64 (Chromium 156, f1dbd2d92f) now reports those blocks on the
console, and the administrator login spec of variant 1 fails on them. That
broke the three compose workspace jobs of main run 37856203791. The same
variant passed on Playwright 1.63 with an identical header.
script-src-attr now carries 'unsafe-inline', which every logout-enabled
deploy already serves through the logout injector. The CSP filter
deduplicates the token there, and script-src keeps the 'unsafe-inline' it
already unions in from script-src-elem.
Verified on a local variant 1 stack. The Playwright trace shows exactly
those two onclick anchors. With the header patched live, the spec passes;
with the original header restored, it fails again with the same two
violations.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
17 lines
1.2 KiB
YAML
17 lines
1.2 KiB
YAML
---
|
|
whitelist:
|
|
script-src-elem:
|
|
- https://cdn.matomo.cloud # nocheck: url
|
|
style-src-elem:
|
|
- https://fonts.googleapis.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
flags:
|
|
script-src-attr:
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: Matomo core renders the top-bar "What's new" entry with an inline onclick (plugins/CoreAdminHome/Menu.php); logout-enabled deploys already grant it through the logout injector
|
|
script-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
style-src-attr:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|