mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
152c7b16ae
The served document runs an inline script at line 38. It is not ours: in the failing variant the Lua body filter renders an empty snippet list, so nothing this repository injects can account for it. Until now the only token that admitted that script came from csp_filters.py, which grants 'unsafe-inline' to script-src-attr and script-src-elem whenever services.logout is enabled. socialhome derives that flag from 'web-svc-logout' in group_names, so the app's own page worked or broke depending on whether an unrelated service shared the round. Measured in run 35152776835. Job 105253846799 reports `Blocked URI: inline`, `Directive: script-src-elem`, `Source: /:38:0`. The two rendered headers differ in exactly that token: variant 0 emits `script-src-elem 'self' 'unsafe-inline' ...`, variant 1 emits `script-src-elem 'self' ...`. csp-checker exits with the violation count, so this single violation failed the hlth-csp unit and sys-service-terminator took the job down after 25 attempts. Rendering build_csp_header against HEAD and against this change confirms the delta is bounded: with logout off the directive gains the token, with logout on nothing moves. script-src-attr stays undeclared because no artifact reports a violation there. An inline hash was considered and dropped. No role in this repository declares meta/csp.yml hashes, the hash would have to byte-match the served document, and csp_filters.py discards every registered hash whenever 'unsafe-inline' is present, which is the state this app is in as soon as logout is deployed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
14 lines
425 B
YAML
14 lines
425 B
YAML
---
|
|
whitelist:
|
|
media-src:
|
|
- "blob:"
|
|
script-src:
|
|
- "blob:"
|
|
style-src-elem:
|
|
- https://fonts.googleapis.com # nocheck: external-cdn,url
|
|
font-src:
|
|
- https://fonts.gstatic.com # nocheck: external-cdn,url
|
|
flags:
|
|
script-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: the served document carries an inline script of its own at line 38, which csp-checker reports and hlth-csp then fails on
|