adopted-ember-addons / adopted-ember-addons/ember-cli-content-security-policy
hashed unsafe-inline support?
Aperta
- Lingua principale
- JavaScript
- Stelle
- 157
- Fork
- 44
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
`unsafe-inline` isn't sufficient to allow `...` on the page. CSP 2 requires those tags to have a hash of their contents. See https://www.w3.org/TR/2015/CR-CSP2-20150721/#script-src-hash-usage
Is there a way for this library to automatically calculate the hashes? Or should addons that use `contentFor` do the hashing and add the results to `config.contentSecurityPolicy['script-src']`? If the latter, could this addon expose an API to make that easier?
See also pgrippi/ember-cli-google-analytics#21
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.