[20019] CSP fixes - #235
Conversation
|
|
||
| <!-- Add OpenGraph image --> | ||
| {% block site_meta %} | ||
| <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; object-src 'none'; script-src 'self' 'sha256-JwTqtIT4e7LB6Y5kTgViobFlnoLQCpMqXc3vZ/B4w3s=' 'sha256-NQL3qWGSgdiWL8VxFi0VRIJ9GX96g2jtPZbkWcycbNU=' 'sha256-TNpu/MoiMxhnOJTYB9OyTq+OyVmbWnczNrAZVkm6PtI=' 'sha256-V+Y6nhx83iyunLSs+LNZmAQKHMpXZyi5jEBym8IixDk=' 'sha256-Vx4j317zP65zcHvm0oDCH71RfjVU08BkU0HdTGJk8fA=' 'sha256-kdrKfx78CitG3qPSAdURgUmgYEGwAYTwjCtRcSGVzxM='; script-src-attr 'none'; style-src 'self'; style-src-attr 'unsafe-hashes' 'sha256-+17AcPK/e5AtiK52Z2vnx3uG3BMzyzRr4Qv5UQsEbDU=' 'sha256-6HSHsKBMUo5p1tyOM1tZ7XlMfW3Mg63/P0SHhSjlbkM=' 'sha256-PjAT9Xrh6xM2sFDPksqOyr8p7HLWEKyH473Fn29HZOk=' 'sha256-TSNypIttKZKWuIyHovnHASEYqnfbslFIpBkhRM2boko=' 'sha256-UuTrggTL1nc8BaRJmlKO75nKSaFmu5VXjiC/0L6Nv2w=' 'sha256-b3y7ZTADltMxSat1ssd4f5JQHdkz4GxlsWf6sIsjPaU=' 'sha256-eC+jXvbVSsG0J4zQfR5fWxxUCqpaa5DZLbINjWNCu48=' 'sha256-iGGEsp6HYRNfdpiKqFg2Y8M+E0xXD5IpUR10EQYD9AE=' 'sha256-prTua5Tv6Xo64NElKgUXoHuJI+z0eDuJ4YYzF1UrLb8=' 'sha256-uZrowBFwhOfSI7mhTbKF5bhNbNCjn8LviGDnEYzoiO0='; img-src 'self' data:; frame-src https://www.youtube.com; form-action 'self'"> |
There was a problem hiding this comment.
I’d avoid putting these SHA hashes directly in overrides/main.html.
They make the CSP very hard to maintain: some of them come from generated MkDocs Material inline scripts, and others from inline style="..." attributes in Markdown/SVG. Any tiny change in generated HTML, theme version, page nesting, formatting, or inline style changes the hash and silently breaks the policy.
I think we should instead move the inline styles to classes in extra.css, fix the SVG style attributes, and if needed override the Material init script so it loads from an external JS file. Then CSP can stay much simpler and maintainable, without a long list of hashes nobody will want to update manually.
Passarinho4
left a comment
Passarinho4
left a comment
There was a problem hiding this comment.
I need to check with Product Team if we should remove GA and hubspot tracking or not.
|
|
||
| <!-- Add OpenGraph image --> | ||
| {% block site_meta %} | ||
| <meta http-equiv="Content-Security-Policy" content=" |
There was a problem hiding this comment.
@Passarinho4
I tried moving the Material initialization to an external JavaScript file. Unfortunately, in Material 6.2.6 the initialization is not exposed as a separate template block.
To externalize it, we have to override the entire scripts block in main.html, which means copying and maintaining Material’s internal bundle paths, translation setup, search configuration, and extra JavaScript loading logic.
In my opinion, this is less maintainable than the original solution. The override is tightly coupled to Material 6.2.6 and would need to be manually compared and updated whenever the theme changes.
I agree that our inline styles should be moved to CSS classes, but for the Material-generated initialization I would prefer to retain the hashes until we upgrade Material to a version that handles the initialization externally.
2 participants
CSP fixes