dependency-check / dependency-check/DependencyCheck

Do not use inline styles, scripts and image in dependency-check-report.html due to CSP

Open
#6,576 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

Currently, the Gradle generated dependency-check-report.html holds inline-styles and scripts.
This is blocked by CSP if you serve the file by a server, like via Jenkins publishHTML.

The only way to get the page working currently is to lower CSP by

`style-src 'self' 'unsafe-inline'` and for script-src (this is strongly disscuraged)

Better is to externalize the styles, scripts and images into separate files and reference in dependency-check-report.html

Only possible way is to download the report html to get it working.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.