Commits on Apr 29, 2024

1. Tighten CSP around script-src and style-src …

   Instead of allowing every src, require scripts from unknown sources to have have a nonce.
   This makes it harder to exploit potential XSS vulnverabilities as the attacker needs to somehow know the nonce beforehand.
   
   This also adds the nonce to all internal scripts. As per sidekiq#3913 (comment) the assets may be hosted
   outside of the main app. Adding the nonce continues to support this usecase.
   
   A nonce is incompatible with `unsafe-inline` (which only style has). Adapt the chart to not assign inline styles directly.
   
   Extensions that load external scripts/styles must either vendor or add the nonce to their tags.
   
   Closes sidekiq#6268

   

   Earlopain committed Apr 29, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 0fabdfc
   • Browse repository at this point

   Copy the full SHA

   0fabdfc View commit details

   Browse the repository at this point in the history

2. Inline csp nonce generation

   

   Earlopain committed Apr 29, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for fa3e32b
   • Browse repository at this point

   Copy the full SHA

   fa3e32b View commit details

   Browse the repository at this point in the history

3. Remove placeholder const

   

   Earlopain committed Apr 29, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for f35de7e
   • Browse repository at this point

   Copy the full SHA

   f35de7e View commit details

   Browse the repository at this point in the history

4. Move csp_nonce into proper helper module

   

   Earlopain committed Apr 29, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 7d1e0b4
   • Browse repository at this point

   Copy the full SHA

   7d1e0b4 View commit details

   Browse the repository at this point in the history