Don't penalize 'unsafe-inline' if hash or nonce source is used, in CSP test

[romainneutron]

Hello,

After analyzing blackfire.io https://observatory.mozilla.org/analyze.html?host=blackfire.io , the report tells me:

Content Security Policy (CSP) implemented, but allows 'unsafe-inline' inside script-src

This is true in case of CSP level1. However, since level2, it's recommended to add unsafe-inline to the script-src directive when you're using a nonce or a hash. In this particular case, the unsafe-inline is discarded, except for browser that do not support CSP level2.

What about taking care of this?

[april]

Oh, this is a good catch. I'll try to work up a code fix for this over the next week. Thanks for pointing that out. Despite working with CSP for so long there are still sometimes little things that are easy to miss.

Thanks for reporting!

[romainneutron]

No problem :)

[mikispag]

+1 on this!

[april]

This should be live now, and I can see that it's now judging things at least more correctly. Let me know if it's still behaving incorrectly, and thanks so much for reporting the bug!

[fmeum]

Following CSP level 2, 'unsafe-inline' in 'style-src' should probably be treated in a similar way.

[april]

Could you open up a new bug for that, please?