The number of URLs is increasing for 'CSP: script-src unsafe-inline' and 'CSP: style-src unsafe-inline' after fixing 'CSP: Wildcard Directive'
Open
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 667
- Forks
- 321
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 1
Description
Hello.
- I has the next report:
The value of CSP was
"default-src 'self'; script-src 'self' cdn.jsdelivr.net 'unsafe-inline'; img-src 'self' validator.swagger.io bootswatch.com getbootstrap.com data:; style-src 'self' cdn.jsdelivr.net 'unsafe-inline'; font-src 'self' cdn.jsdelivr.net data:; connect-src 'self' bootswatch.com;" - I fixed CSP: Wildcard Directive by adding form-action 'self'; frame-ancestors 'self' and received the next report:
- My question is why the number of URLs in CSP: script-src unsafe-inline and CSP: style-src unsafe-inline was increased?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CSP value quoted in the issue and compare the two attached reports, focusing on the change from the original policy to the policy with form-action and frame-ancestors. Determine whether the increased URL counts are expected or indicate a site configuration problem; done means the cause and any required change are clearly established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100