mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
596b10c403
unsafe-inline re-admits the inline execution an XSS needs and unsafe-eval re-admits string-to-code, so a CSP relaxation must be verified against the running app rather than copied from another role. The new lint requires a nocheck marker plus a Reason on the flag's own line, so a marker cannot drift to the neighbouring directive. The 197 pre-existing grants across 70 roles are checked out with a TODO: they were never verified and still have to be. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
24 lines
1.3 KiB
YAML
24 lines
1.3 KiB
YAML
---
|
|
flags:
|
|
script-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
script-src-attr:
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
style-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
style-src-attr:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
|
|
whitelist:
|
|
connect-src:
|
|
- "{{ lookup('domain', 'web-app-odoo') }}"
|
|
- "wss://{{ lookup('domain', 'web-app-odoo') }}"
|
|
frame-ancestors:
|
|
- "{{ DOMAIN_PRIMARY }}"
|
|
- "*.{{ DOMAIN_PRIMARY }}"
|
|
font-src:
|
|
- "data:"
|
|
- https://fonts.gstatic.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|
|
style-src-elem:
|
|
- https://fonts.googleapis.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
|