Content-Security-Policy

[bamboleeeero-bamboleeeero]

There seems to be a bunch of inline scripts or style rules such as this that don't play nice with CSP. These should be replaced by a CSS class.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[bkcsoft]

Yes, that should be a class, not inline style :)

[Eriner]

As a note: report-uri is a CSP directive that informs the browser where to report violations. Something to consider is providing/setting this directive and ingesting it into gitea to make it available to administrators.

[denji]

https://github.com/unrolled/secure#content-security-policy

• https://github.com/awakenetworks/csp

[Bwko]

I'm currently implementing a Content-Security-Policy but we need style-src: unsafe-inline & script-src: unsafe-eval for semantic ui & jquery datetimepicker.
@bamboleeeero-bamboleeeero any advice on this?

[tboerger]

We should get rid of all inline crap.

[Bwko]

@tboerger I'm almost done with that (except for labels) but for tooltips semantic ui needs unsafe-inline 😕

[tboerger]

Even tooltips can be perfectly done with data attributes and unobtrusive js.

[hasufell]

any news?

[clarfonthey]

Personally, I would appreciate at least adding a content-security-policy header to Gitea, slowly making it more strict as changes are made. At least things like form-action and frame-ancestors would be nice, which are doable now.

I'd be willing to work on this within the next few days if someone more-acquainted with the codebase isn't up to it!

[toth-dev]

I'm adding this CSP with nginx:

default-src 'none'; base-uri 'none'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; connect-src 'self'; form-action 'self'

Everything seems to work with this.

[hasufell]

@totpet interesting, I tried that too and it seems to work so far, but afais mozilla observatory reports this as -20 score, so it seems to be too lax.

[clarfonthey]

As I said, things like frame-ancestors and form-action are really important parts of CSP that we could add for existing gitea. Adding unsafe-inline and unsafe-eval to JavaScript are really bad though, and that pretty much negates everything else.