Skip to content
This repository has been archived by the owner on Apr 6, 2020. It is now read-only.

Additional CSP Issues #11

Closed
pes10k opened this issue Oct 22, 2017 · 1 comment
Closed

Additional CSP Issues #11

pes10k opened this issue Oct 22, 2017 · 1 comment
Labels
bug
Milestone
0.9.3

Comments

@pes10k
Copy link
Owner

pes10k commented Oct 22, 2017

The following CSP keeps the injected script from executing…

default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data: blob:; media-src https: data: blob:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests; report-uri https://capture.condenastdigital.com/csp/pitchfork
@pes10k
Copy link
Owner Author

pes10k commented Oct 22, 2017

The previous changes in b3a7659 fixed a large number of CSP issues, by calculating the SHA256 of the injected code, and modifying the CSP header to whitelist the added code.

But the above command is stopping the code from executing…

@pes10k pes10k added this to the 0.9.3 milestone Oct 22, 2017
@pes10k pes10k added the bug label Oct 22, 2017
@crssi crssi mentioned this issue Oct 22, 2017
Closed
@pes10k pes10k closed this as completed in 0bd91f6 Oct 23, 2017
@pes10k pes10k modified the milestone: 0.9.3 Oct 23, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
0.9.3
Development

No branches or pull requests
1 participant
@pes10k