darkreader / darkreader/darkreader

Content Security Policy blocks inline execution

Open
#9,502 4 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
22.4k
Forks
2.7k
Avg merge
21h 11m
Merged PRs (30d)
78

Description

## Bug Description
It seems that when we want to activate darkreader it throws this error. as in the following you can see the error. It comes from the Content Security Policy added by the administrator of the website as they insist this should be fixed.
Although it seems that the darkreader is running and working as expected so I guess there is no worries from that perspective.

But you know that security polices to prevent inline css/javascript is known as a best practice to websites/web applications which external users might exploit the application adversely.

There are some workaround to let inline scripts as mentioned here https://web.dev/csp/#if-you-absolutely-must-use-it but unfortunately security teams has their strict policies and internal dependencies and requirements to let this pass.

I created this issue to have it documented and could be considered by the development team here. Thanks for you attention!

## Screenshots
![image](https://user-images.githubusercontent.com/71076920/183677515-0631a0b8-d4ee-4872-99d1-ac19993699fd.png)

- OS: Windows, macOS, Linux
- Browser: latest versions of Chrome, Firefox, Edge, Safari
- Dark Reader Version: 4.9.46

## Additional Context
The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets. To solve this, move all inline scripts (e.g. onclick=[JS code]) and styles into external files. ⚠️ Allowing inline execution comes at the risk of script injection via injection of HTML script elements. If you absolutely must, you can allow inline script and styles by: adding unsafe-inline as a source to the CSP header adding the hash or nonce of the inline script to your CSP header.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.