harden: move the 39 static style attributes onto classes and drop 'unsafe-inline' from style-src #328

New Issue

clawbot · 2026-08-20T13:47:43+02:00

clawbot commented

2026-08-20 13:47:43 +02:00

Follow-up to #307, from its review (#327 (comment)). The default-src 'self' policy that landed carries one loosening that is removable, unlike the other two.

style-src 'unsafe-inline' is required today only because 39 static style="..." attributes remain in src/popup/index.html and the view helpers. No narrower spelling works cross-engine: Firefox implements neither style-src-attr nor 'unsafe-hashes', so the choice is 'unsafe-inline' or no inline style attributes at all.

Worth recording because it is easy to get wrong: the 57 .style.foo = assignments are CSSOM and CSP-exempt. They do not force the loosening and do not need changing. Only the 39 markup attributes do.

Residual risk today is small — with escaping now in place nothing can inject a style attribute, and img-src 'self' data: plus font-src falling back to default-src 'self' shut the usual CSS exfiltration channels. This is defence in depth, not an open hole, which is why it is not in the 1.0.0 milestone.

The other two loosenings are not removable and should not be attempted here: connect-src https: http: cannot be narrowed because a static manifest cannot know a user-configured RPC endpoint, and img-src data: is required by blockies.

Definition of done

The 39 static style="..." attributes are expressed as Tailwind classes or equivalent, consistent with the repo's no-custom-CSS-classes rule in README.md.
style-src 'self' in both manifests, pinned in tests/manifest.test.js.
Both browser suites green — make test-e2e and make test-e2e-firefox — with real counts reported. A CSP tightening that passes unit tests and breaks a screen in a browser is the failure mode here.
Zero CSP violations, asserted rather than assumed: the Chrome harness already fails a run on any page console.error, so a Refused to apply inline style reddens the suite. Confirm Firefox logs no manifest-CSP parse error, i.e. the policy was accepted rather than silently discarded.
No layout regression on the fixed 360x600 popup.
make check green.

Follow-up to https://git.eeqj.de/sneak/AutistMask/issues/307, from its review (https://git.eeqj.de/sneak/AutistMask/pulls/327#issuecomment-67567). The `default-src 'self'` policy that landed carries one loosening that is removable, unlike the other two. `style-src 'unsafe-inline'` is required today only because **39 static `style="..."` attributes** remain in `src/popup/index.html` and the view helpers. No narrower spelling works cross-engine: Firefox implements neither `style-src-attr` nor `'unsafe-hashes'`, so the choice is `'unsafe-inline'` or no inline style attributes at all. Worth recording because it is easy to get wrong: the **57 `.style.foo =` assignments are CSSOM and CSP-exempt**. They do not force the loosening and do not need changing. Only the 39 markup attributes do. Residual risk today is small — with escaping now in place nothing can inject a `style` attribute, and `img-src 'self' data:` plus `font-src` falling back to `default-src 'self'` shut the usual CSS exfiltration channels. This is defence in depth, not an open hole, which is why it is not in the 1.0.0 milestone. The other two loosenings are **not** removable and should not be attempted here: `connect-src https: http:` cannot be narrowed because a static manifest cannot know a user-configured RPC endpoint, and `img-src data:` is required by blockies. ## Definition of done - [ ] The 39 static `style="..."` attributes are expressed as Tailwind classes or equivalent, consistent with the repo's no-custom-CSS-classes rule in `README.md`. - [ ] `style-src 'self'` in both manifests, pinned in `tests/manifest.test.js`. - [ ] Both browser suites green — `make test-e2e` and `make test-e2e-firefox` — with real counts reported. A CSP tightening that passes unit tests and breaks a screen in a browser is the failure mode here. - [ ] Zero CSP violations, asserted rather than assumed: the Chrome harness already fails a run on any page `console.error`, so a `Refused to apply inline style` reddens the suite. Confirm Firefox logs no manifest-CSP parse error, i.e. the policy was accepted rather than silently discarded. - [ ] No layout regression on the fixed 360x600 popup. - [ ] `make check` green.

clawbot referenced this issue

2026-08-20 14:26:18 +02:00

pre-1.0 security review: key handling, DEBUG-mode policy, RPC input validation #303

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#328