From a73253ad5c6b7736120f5ce7cd3746d7230801d3 Mon Sep 17 00:00:00 2001 From: Benjamin Michaelis Date: Tue, 19 May 2026 21:43:18 -0700 Subject: [PATCH 1/3] security: remove style-src unsafe-inline Replaces inline style attributes in Razor views with CSS classes and updates CSP style-src to drop unsafe-inline while preserving required external origins. --- .../Manage/TwoFactorAuthentication.cshtml | 2 +- .../Pages/_PasswordStrengthMeter.cshtml | 4 +- EssentialCSharp.Web/Program.cs | 2 +- EssentialCSharp.Web/Views/Home/About.cshtml | 6 +-- .../Views/Home/Guidelines.cshtml | 12 ++--- EssentialCSharp.Web/Views/Home/Home.cshtml | 2 +- .../Views/McpSetup/Index.cshtml | 4 +- .../Views/Shared/_Layout.cshtml | 2 +- EssentialCSharp.Web/wwwroot/css/styles.css | 49 +++++++++++++++++++ 9 files changed, 66 insertions(+), 17 deletions(-) diff --git a/EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/TwoFactorAuthentication.cshtml b/EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/TwoFactorAuthentication.cshtml index 7bf35e76..0fbc38d8 100644 --- a/EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/TwoFactorAuthentication.cshtml +++ b/EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/TwoFactorAuthentication.cshtml @@ -38,7 +38,7 @@ ViewData["ActivePage"] = ManageNavPages.TwoFactorAuthentication; if (Model.IsMachineRemembered) { -
+
} diff --git a/EssentialCSharp.Web/Areas/Identity/Pages/_PasswordStrengthMeter.cshtml b/EssentialCSharp.Web/Areas/Identity/Pages/_PasswordStrengthMeter.cshtml index 36e3095a..1b3e8ff5 100644 --- a/EssentialCSharp.Web/Areas/Identity/Pages/_PasswordStrengthMeter.cshtml +++ b/EssentialCSharp.Web/Areas/Identity/Pages/_PasswordStrengthMeter.cshtml @@ -17,10 +17,10 @@ data-user-input-fields="@Model.UserInputFieldIds" data-min-length="@EssentialCSharp.Web.Services.PasswordRequirementOptions.PasswordMinimumLength">
-
-
+
@@ -38,7 +38,7 @@
@@ -70,4 +70,4 @@ - \ No newline at end of file + diff --git a/EssentialCSharp.Web/Views/Home/Guidelines.cshtml b/EssentialCSharp.Web/Views/Home/Guidelines.cshtml index cb2a4842..cd2e9aee 100644 --- a/EssentialCSharp.Web/Views/Home/Guidelines.cshtml +++ b/EssentialCSharp.Web/Views/Home/Guidelines.cshtml @@ -53,7 +53,7 @@ foreach (var guideline in group) {
- + @guideline.Guideline
} @@ -75,14 +75,14 @@ }; } - private string GetColorForType(GuidelineType type) + private string GetColorClassForType(GuidelineType type) { return type switch { - GuidelineType.DoNot => "#ff0000", - GuidelineType.Avoid => "#ff0000", - GuidelineType.Consider => "#7a7a7a", - GuidelineType.Do => "#63E6BE", + GuidelineType.DoNot => "guideline-color-do-not", + GuidelineType.Avoid => "guideline-color-avoid", + GuidelineType.Consider => "guideline-color-consider", + GuidelineType.Do => "guideline-color-do", _ => string.Empty, }; } diff --git a/EssentialCSharp.Web/Views/Home/Home.cshtml b/EssentialCSharp.Web/Views/Home/Home.cshtml index 5c96fb51..64539cb1 100644 --- a/EssentialCSharp.Web/Views/Home/Home.cshtml +++ b/EssentialCSharp.Web/Views/Home/Home.cshtml @@ -36,7 +36,7 @@
diff --git a/EssentialCSharp.Web/Views/McpSetup/Index.cshtml b/EssentialCSharp.Web/Views/McpSetup/Index.cshtml index 8f027d09..b282202d 100644 --- a/EssentialCSharp.Web/Views/McpSetup/Index.cshtml +++ b/EssentialCSharp.Web/Views/McpSetup/Index.cshtml @@ -9,7 +9,7 @@ bool isSignedIn = SignInManager.IsSignedIn(User); } -
+
@@ -267,7 +267,7 @@ @foreach (var tool in Model) {
- + @tool.Name @tool.Title diff --git a/EssentialCSharp.Web/Views/Shared/_Layout.cshtml b/EssentialCSharp.Web/Views/Shared/_Layout.cshtml index 57061fbe..8cfda0ec 100644 --- a/EssentialCSharp.Web/Views/Shared/_Layout.cshtml +++ b/EssentialCSharp.Web/Views/Shared/_Layout.cshtml @@ -182,7 +182,7 @@
- +
diff --git a/EssentialCSharp.Web/wwwroot/css/styles.css b/EssentialCSharp.Web/wwwroot/css/styles.css index 302ef70a..e186265f 100644 --- a/EssentialCSharp.Web/wwwroot/css/styles.css +++ b/EssentialCSharp.Web/wwwroot/css/styles.css @@ -786,6 +786,49 @@ details > summary::-webkit-details-marker { padding-left: 1em; } +/* CSP inline-style replacements */ +.mcp-setup-container { + max-width: 900px; +} + +.mcp-tool-summary { + cursor: pointer; + list-style: none; +} + +.password-strength-progress { + height: 6px; +} + +.password-strength-bar-initial { + width: 0; +} + +.guideline-icon { + padding-right: 10px; +} + +.guideline-color-do-not, +.guideline-color-avoid { + color: #ff0000; +} + +.guideline-color-consider { + color: #7a7a7a; +} + +.guideline-color-do { + color: #63E6BE; +} + +.intellitect-logo-img { + height: 75px; +} + +.ecs-book-cover-img { + height: 450px; +} + /* Home Page Styles */ .quote { @@ -1079,6 +1122,12 @@ button.accept-policy { } /* Reduced motion support */ + +/* Guidelines Icon Styles */ +.guideline-icon { + color: var(--guideline-color); + padding-right: 10px; +} @media (prefers-reduced-motion: reduce) { .captcha-modal-overlay, .captcha-modal-card { From d2e7aff090de33008397224f93aafa93180165ee Mon Sep 17 00:00:00 2001 From: Benjamin Michaelis Date: Tue, 19 May 2026 22:01:03 -0700 Subject: [PATCH 2/3] fix: address CSP review feedback Move MCP setup chevron styles out of inline script section, remove duplicate guideline icon CSS override, and switch password meter width updates to CSP-safe CSS classes. --- .../Views/McpSetup/Index.cshtml | 11 ------ EssentialCSharp.Web/wwwroot/css/styles.css | 36 ++++++++++++++++--- .../wwwroot/js/password-strength.js | 16 ++++----- 3 files changed, 38 insertions(+), 25 deletions(-) diff --git a/EssentialCSharp.Web/Views/McpSetup/Index.cshtml b/EssentialCSharp.Web/Views/McpSetup/Index.cshtml index b282202d..460362df 100644 --- a/EssentialCSharp.Web/Views/McpSetup/Index.cshtml +++ b/EssentialCSharp.Web/Views/McpSetup/Index.cshtml @@ -380,17 +380,6 @@
@section Scripts { -