WT-536: improve our CSP unsafe-inline config by making it tighter and more specific #16994
+10
−4
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…in for CMS deployment
…nd is enabled Note that the previous cut of the code didn't add style-src: unsafe inline only in Transcend mode: it was enabled all the time
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #16994 +/- ##
==========================================
+ Coverage 80.36% 81.08% +0.72%
==========================================
Files 163 157 -6
Lines 9100 8313 -787
==========================================
- Hits 7313 6741 -572
+ Misses 1787 1572 -215 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This changeset is an additional fixup around https://mozilla-hub.atlassian.net/browse/WT-536
It does a few things. My recommendation is to read the code first, then the rest of this description, so you are not swayed (and in case I've not got this right)
for
script-src, it only allowsunsafe-inlinefor the Wagtail admin pages which are only enabled for the CMS deployment. This does not appear to affect anything else, but we really need to be sure (eg Transcend, GA, cookie banner)for
style-srcwe had code that enabledunsafe-inlinespecifically for Transcend, but a few lines above we also hadunsafe-inlineset as a default. This changeset moves it so thatstyle-src: unsafe-inlineis only available if transcend is enabled.Testing
I'd welcome a Slack chat about approaches here. I've pushed this branch to www-demo6.allizom.org where we can drive around and also try the CMS, but Transcend isn't enabled there - maybe we could enable it in demos too, tbc on @stephendherrera's blessing