mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
d721e887a5
The dashboard sent script-src 'unsafe-inline' from two sources. Its own meta/csp.yml granted it to script-src-attr, and build_csp_header adds it to script-src-elem and script-src-attr for every app with services.logout.enabled. Both reach script-src through the family union, and the token in script-src-elem also closes the hash gate, so the hashes that sys-front-inj-javascript, -dashboard, -logout and -matomo register for their inline snippets were discarded. build_csp_header now skips the logout grant on a directive whose meta/csp.yml sets unsafe-inline: false. Only web-app-dashboard sets it: on script-src and script-src-elem. Its injected snippets now run by hash and the logout one-liner is hashed like the others. A render of build_csp_header for every role, variant, logout on/off and tor on/off (1712 headers) differs from origin/main only in the 8 web-app-dashboard headers; the 86 other roles that declare a logout service render byte-identical policies. script-src-attr keeps 'unsafe-inline': port-ui 2.2.2 still renders inline event handlers (menu onclick entries, openDynamicPopup, closeAllModals, the card image onerror). It goes once the port-ui release without inline handlers is pinned and header.yml.j2 moves from onclick to action. The dashboard Playwright spec asserts that script-src and script-src-elem carry no 'unsafe-inline' on the landing page, next to its existing check for CSP violations. Refs #1122 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>