search

disconnectme / disconnect

Disconnect is a browser extension that makes the web faster, more private, and more secure.
https://disconnect.me/
GNU General Public License v3.0
780 stars 136 forks source link

remove 'unsafe-eval' in CSP script-src #376

Open roycewilliams opened 5 years ago

roycewilliams commented 5 years ago

Following up on this advice from @gorhill, please investigate feasibility / LOE for removing 'unsafe' clauses from the Content Security Policy in the manifest.

https://github.com/disconnectme/disconnect/blob/8793a575b1b88e9ef75d554a617e92f84b1799e4/firefox/content/disconnect.safariextension/opera/chrome/manifest.json#L22

https://github.com/disconnectme/disconnect/blob/8793a575b1b88e9ef75d554a617e92f84b1799e4/firefox/content/disconnect.safariextension/opera/manifest.json#L20

Update: also, since blob: and filesystem: are both whitelisted by default within script-src, please configure both of these to explicitly control remote code execution.