mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-05-04 18:08:46 +03:00
CSP best practice #709
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @TBK on GitHub (Jun 8, 2018).
CSP deems inline CSS & JS unsafe - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
Currently BookStack requires `Content-Security-Policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';`` because of the inline CSS code in https://github.com/BookStackApp/BookStack/blob/master/resources/views/partials/custom-styles.blade.php and JS code https://github.com/BookStackApp/BookStack/blob/master/resources/views/settings/index.blade.php#L162
Another CSP issue is with the use of .globalEval in app.js.
Would a possible solution for custom-styles.blade.php be to move the css code to a file and update the file when the value is changed through the settings page?
I have not been able to trace .globalEval but I think it is coming from jQuery.
@ssddanbrown commented on GitHub (Nov 8, 2022):
I'm going to close this off since the CSP situation in BookStack has changed since this request. CSP is now built-in using nonce-based CSP rules.