dependency-check / dependency-check/DependencyCheck
Do not use inline styles, scripts and image in dependency-check-report.html due to CSP
Open
enhancement
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
Currently, the Gradle generated dependency-check-report.html holds inline-styles and scripts.
This is blocked by CSP if you serve the file by a server, like via Jenkins publishHTML.
The only way to get the page working currently is to lower CSP by
`style-src 'self' 'unsafe-inline'` and for script-src (this is strongly disscuraged)
Better is to externalize the styles, scripts and images into separate files and reference in dependency-check-report.html
Only possible way is to download the report html to get it working.
Contributor guide
Assessment
This issue has not been assessed yet.