Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove misconfigured WTFs #71

Closed
Zenexer opened this issue Dec 8, 2018 · 5 comments
Closed

Remove misconfigured WTFs #71

Zenexer opened this issue Dec 8, 2018 · 5 comments
Assignees

Comments

@Zenexer
Copy link

Zenexer commented Dec 8, 2018

Many of the WTFs are just the result of misconfigured CSP directives. For example:

Those are both lacking 'self' for style-src, so their styles are getting blocked.

A good chunk of the script-sample entries fall into this category. Anything with blocked-uri: self should be considered to be a misconfiguration--the developer is simply missing 'self'.

@nico3333fr nico3333fr self-assigned this Jan 25, 2019
@nico3333fr
Copy link
Owner

No, these styles are not present on the website and self is defined in CSP headers.

@MaceWindu
Copy link
Contributor

actually first one is probably from this extension https://github.com/daidaiworm/vimium

see this file https://searchcode.com/codesearch/view/26916074/

@MaceWindu
Copy link
Contributor

Looking at second one I suspect it is also some SEO/malware extension to spam forums with SEO links as this snippet could be found alot on different message boards and it it adds extra styles to seo-related links.

@MaceWindu
Copy link
Contributor

Close as explained?

@nico3333fr
Copy link
Owner

@MaceWindu yes, closed :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants