darkreader / darkreader/darkreader
Content Security Policy blocks inline execution
- Dominant language
- TypeScript
- Stars
- 22.4k
- Forks
- 2.7k
- Avg merge
- 21h 11m
- Merged PRs (30d)
- 78
Description
## Bug Description
It seems that when we want to activate darkreader it throws this error. as in the following you can see the error. It comes from the Content Security Policy added by the administrator of the website as they insist this should be fixed.
Although it seems that the darkreader is running and working as expected so I guess there is no worries from that perspective.
But you know that security polices to prevent inline css/javascript is known as a best practice to websites/web applications which external users might exploit the application adversely.
There are some workaround to let inline scripts as mentioned here https://web.dev/csp/#if-you-absolutely-must-use-it but unfortunately security teams has their strict policies and internal dependencies and requirements to let this pass.
I created this issue to have it documented and could be considered by the development team here. Thanks for you attention!
## Screenshots

- OS: Windows, macOS, Linux
- Browser: latest versions of Chrome, Firefox, Edge, Safari
- Dark Reader Version: 4.9.46
## Additional Context
The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets. To solve this, move all inline scripts (e.g. onclick=[JS code]) and styles into external files. ⚠️ Allowing inline execution comes at the risk of script injection via injection of HTML script elements. If you absolutely must, you can allow inline script and styles by: adding unsafe-inline as a source to the CSP header adding the hash or nonce of the inline script to your CSP header.
Contributor guide
Assessment
This issue has not been assessed yet.