[20019] CSP fixes - #235
Conversation
|
|
||
| <!-- Add OpenGraph image --> | ||
| {% block site_meta %} | ||
| <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; object-src 'none'; script-src 'self' 'sha256-JwTqtIT4e7LB6Y5kTgViobFlnoLQCpMqXc3vZ/B4w3s=' 'sha256-NQL3qWGSgdiWL8VxFi0VRIJ9GX96g2jtPZbkWcycbNU=' 'sha256-TNpu/MoiMxhnOJTYB9OyTq+OyVmbWnczNrAZVkm6PtI=' 'sha256-V+Y6nhx83iyunLSs+LNZmAQKHMpXZyi5jEBym8IixDk=' 'sha256-Vx4j317zP65zcHvm0oDCH71RfjVU08BkU0HdTGJk8fA=' 'sha256-kdrKfx78CitG3qPSAdURgUmgYEGwAYTwjCtRcSGVzxM='; script-src-attr 'none'; style-src 'self'; style-src-attr 'unsafe-hashes' 'sha256-+17AcPK/e5AtiK52Z2vnx3uG3BMzyzRr4Qv5UQsEbDU=' 'sha256-6HSHsKBMUo5p1tyOM1tZ7XlMfW3Mg63/P0SHhSjlbkM=' 'sha256-PjAT9Xrh6xM2sFDPksqOyr8p7HLWEKyH473Fn29HZOk=' 'sha256-TSNypIttKZKWuIyHovnHASEYqnfbslFIpBkhRM2boko=' 'sha256-UuTrggTL1nc8BaRJmlKO75nKSaFmu5VXjiC/0L6Nv2w=' 'sha256-b3y7ZTADltMxSat1ssd4f5JQHdkz4GxlsWf6sIsjPaU=' 'sha256-eC+jXvbVSsG0J4zQfR5fWxxUCqpaa5DZLbINjWNCu48=' 'sha256-iGGEsp6HYRNfdpiKqFg2Y8M+E0xXD5IpUR10EQYD9AE=' 'sha256-prTua5Tv6Xo64NElKgUXoHuJI+z0eDuJ4YYzF1UrLb8=' 'sha256-uZrowBFwhOfSI7mhTbKF5bhNbNCjn8LviGDnEYzoiO0='; img-src 'self' data:; frame-src https://www.youtube.com; form-action 'self'"> |
There was a problem hiding this comment.
I’d avoid putting these SHA hashes directly in overrides/main.html.
They make the CSP very hard to maintain: some of them come from generated MkDocs Material inline scripts, and others from inline style="..." attributes in Markdown/SVG. Any tiny change in generated HTML, theme version, page nesting, formatting, or inline style changes the hash and silently breaks the policy.
I think we should instead move the inline styles to classes in extra.css, fix the SVG style attributes, and if needed override the Material init script so it loads from an external JS file. Then CSP can stay much simpler and maintainable, without a long list of hashes nobody will want to update manually.
Passarinho4
left a comment
Passarinho4
left a comment
There was a problem hiding this comment.
I need to check with Product Team if we should remove GA and hubspot tracking or not.
2 participants
CSP fixes