Skip to content

[20019] CSP fixes #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
czarekeltonjohn wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[20019] CSP fixes #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions docs/stylesheets/extra.css
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
@import url('https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap');


.topLinePageInfo {
Expand All @@ -11,7 +10,7 @@
.topLinePageInfo__text {
color: #000;
font-size: 16px;
font-family: Roboto;
font-family: Roboto, sans-serif;
font-style: normal;
line-height: 32px;
letter-spacing: 0.15px;
Expand Down Expand Up @@ -63,7 +62,7 @@
transition: .2s;
text-decoration: none;
cursor: pointer;
font-family: Roboto;
font-family: Roboto, sans-serif;
background-color: #ffd100;
border: 2px solid #ffd100;
color: #000;
Expand Down
4 changes: 1 addition & 3 deletions mkdocs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ site_name: IoT Developer Zone
theme:
name: material
custom_dir: overrides
font: false
logo: assets/images/logo.svg
favicon: assets/favicon/favicon-32x32.png
features:
Expand Down Expand Up @@ -46,9 +47,6 @@ plugins:
hooks:
- main.py

google_analytics:
- UA-25246208-6
- auto

nav:
- 'Getting Started':
Expand Down
10 changes: 1 addition & 9 deletions overrides/main.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,6 @@
<meta name="theme-color" content="#ffffff">
<!-- end favicon -->

<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-1572272-2"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());

gtag('config', 'UA-1572272-2');
</script>
{% endblock %}


Expand Down Expand Up @@ -120,6 +111,7 @@ <h1>{{ page.title | d(config.site_name, true)}}</h1>

<!-- Add OpenGraph image -->
{% block site_meta %}
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; object-src 'none'; script-src 'self' 'sha256-JwTqtIT4e7LB6Y5kTgViobFlnoLQCpMqXc3vZ/B4w3s=' 'sha256-NQL3qWGSgdiWL8VxFi0VRIJ9GX96g2jtPZbkWcycbNU=' 'sha256-TNpu/MoiMxhnOJTYB9OyTq+OyVmbWnczNrAZVkm6PtI=' 'sha256-V+Y6nhx83iyunLSs+LNZmAQKHMpXZyi5jEBym8IixDk=' 'sha256-Vx4j317zP65zcHvm0oDCH71RfjVU08BkU0HdTGJk8fA=' 'sha256-kdrKfx78CitG3qPSAdURgUmgYEGwAYTwjCtRcSGVzxM='; script-src-attr 'none'; style-src 'self'; style-src-attr 'unsafe-hashes' 'sha256-+17AcPK/e5AtiK52Z2vnx3uG3BMzyzRr4Qv5UQsEbDU=' 'sha256-6HSHsKBMUo5p1tyOM1tZ7XlMfW3Mg63/P0SHhSjlbkM=' 'sha256-PjAT9Xrh6xM2sFDPksqOyr8p7HLWEKyH473Fn29HZOk=' 'sha256-TSNypIttKZKWuIyHovnHASEYqnfbslFIpBkhRM2boko=' 'sha256-UuTrggTL1nc8BaRJmlKO75nKSaFmu5VXjiC/0L6Nv2w=' 'sha256-b3y7ZTADltMxSat1ssd4f5JQHdkz4GxlsWf6sIsjPaU=' 'sha256-eC+jXvbVSsG0J4zQfR5fWxxUCqpaa5DZLbINjWNCu48=' 'sha256-iGGEsp6HYRNfdpiKqFg2Y8M+E0xXD5IpUR10EQYD9AE=' 'sha256-prTua5Tv6Xo64NElKgUXoHuJI+z0eDuJ4YYzF1UrLb8=' 'sha256-uZrowBFwhOfSI7mhTbKF5bhNbNCjn8LviGDnEYzoiO0='; img-src 'self' data:; frame-src https://www.youtube.com; form-action 'self'">

@Passarinho4 Passarinho4 Aug 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’d avoid putting these SHA hashes directly in overrides/main.html.

They make the CSP very hard to maintain: some of them come from generated MkDocs Material inline scripts, and others from inline style="..." attributes in Markdown/SVG. Any tiny change in generated HTML, theme version, page nesting, formatting, or inline style changes the hash and silently breaks the policy.

I think we should instead move the inline styles to classes in extra.css, fix the SVG style attributes, and if needed override the Material init script so it loads from an external JS file. Then CSP can stay much simpler and maintainable, without a long list of hashes nobody will want to update manually.

{{ super() }}
<meta content="https://iotdevzone.avsystem.com/docs/img/AVSystem-social.png" property="og:image" />
{% endblock %}
Expand Down
4 changes: 0 additions & 4 deletions overrides/partials/footer.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,3 @@
</div>
</footer>

<!-- Start of HubSpot Embed Code -->
<script type="text/javascript" id="hs-script-loader" async defer src="//js-eu1.hs-scripts.com/139620700.js"></script>
<!-- End of HubSpot Embed Code -->