search

mozilla / bedrock

Making mozilla.org awesome, one pebble at a time
https://www.mozilla.org
Mozilla Public License 2.0
1.18k stars 918 forks source link

Remove `unsafe-eval` & `unsafe-inline` from `script-src` #14828

Open robhudson opened 4 months ago

robhudson commented 4 months ago

As mentioned in the comments, "The last inlined style was removed in #14614 and I couldn't find any more of such occurrences so hopefully the unsafes can be gone soon."

stevejalim commented 4 months ago

Forgive me if this is already thought of, but the Wagtail admin may well still need unsafe-eval - would you mind checking and adding to the CMS-only CSP if need be?

robhudson commented 4 months ago

Thanks for reminding me. And yeah, I can fire up the admin and check it.