sneak/pixa
1
0
Fork 0
Code Issues 50 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Remove unsafe-inline from the Content-Security-Policy: move inline handlers and runtime Tailwind styles into served assets #125

New Issue
Open
opened 2026-09-21 20:43:36 +02:00 by clawbot · 0 comments
clawbot commented 2026-09-21 20:43:36 +02:00
Collaborator
Copy Link
Copy Source

The Content-Security-Policy added for #91 allows 'unsafe-inline' in script-src and style-src, for two reasons found in the tree:

  • internal/templates/generator.html uses inline onclick handlers.
  • The bundled internal/static/tailwind.js builds styles in the browser and injects a <style> element at runtime.

REPO_POLICIES.md asks for a restrictive policy and a documented reason for any unsafe-inline; the reason is documented, this issue removes the need.

Definition of done

  1. The inline onclick handlers move into a script file served from internal/static, attached with addEventListener.
  2. The runtime Tailwind script is replaced by a stylesheet built ahead of time and served from internal/static (or, if that needs a build step the repo should not carry, say so on the PR with the reading taken and keep style-src as the only relaxed directive).
  3. SecurityHeaders() drops 'unsafe-inline' from script-src, and from style-src if item 2 is done; its test asserts the absence.
  4. The login and generator pages are loaded in a real browser engine or checked from served HTML under the new policy: login, URL generation and the copy button still work. State in the PR body that this was done.
  5. make check green.

Not a blocker for the beta deployment; it is hardening for 1.0.

Model: fable-5-1

The Content-Security-Policy added for https://git.eeqj.de/sneak/pixa/issues/91 allows `'unsafe-inline'` in `script-src` and `style-src`, for two reasons found in the tree: - `internal/templates/generator.html` uses inline `onclick` handlers. - The bundled `internal/static/tailwind.js` builds styles in the browser and injects a `<style>` element at runtime. `REPO_POLICIES.md` asks for a restrictive policy and a documented reason for any `unsafe-inline`; the reason is documented, this issue removes the need. ## Definition of done 1. The inline `onclick` handlers move into a script file served from `internal/static`, attached with `addEventListener`. 2. The runtime Tailwind script is replaced by a stylesheet built ahead of time and served from `internal/static` (or, if that needs a build step the repo should not carry, say so on the PR with the reading taken and keep `style-src` as the only relaxed directive). 3. `SecurityHeaders()` drops `'unsafe-inline'` from `script-src`, and from `style-src` if item 2 is done; its test asserts the absence. 4. The login and generator pages are loaded in a real browser engine or checked from served HTML under the new policy: login, URL generation and the copy button still work. State in the PR body that this was done. 5. `make check` green. Not a blocker for the beta deployment; it is hardening for 1.0. Model: fable-5-1
clawbot added this to the 1.0.0 milestone 2026-09-21 20:43:36 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone 1.0.0
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/pixa#125