Online Security Policy breaks the interface

[ghost]

Description

After employing Online Security Policy i.e. CSP gitea interface has some issues.

When applying the following rules:

Content-Security-Policy
default-src 'self' *.x-files.dk *.cloudflare.com fonts.googleapis.com fonts.gstatic.com; frame-ancestors 'self' *.x-files.dk; object-src *.x-files.dk/; script-src *.x-files.dk/; style-src 'self'; font-src 'self' data:;

So for this to work I had to add the following which is below best practice for CSP

default-src 'self' *.x-files.dk *.cloudflare.com fonts.googleapis.com fonts.gstatic.com https://secure.gravatar.com; frame-ancestors 'self' *.x-files.dk; object-src *.x-files.dk/; script-src *.x-files.dk/ 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self' data:;

No one absolutetly no one should ever use: 'unsafe-inline' as well as 'unsafe-eval' in their Content Security Policy.

Gitea Version

gitea-1.17.2-linux-amd64

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

N/A

Screenshots

Git Version

gitea-1.17.2-linux-amd64

Operating System

Ubuntu 22.04

How are you running Gitea?

Runs as a service on a stand alone server.

Database

MySQL

[wxiaoguang]

Related to this one

• Branch selector disappear immediately (Uncaught EvalError: 'unsafe-eval' is not an allowed) #19851

[silverwind]

Inline scripts are currently necessary for the clone script which we should remove.
Inline styles will be a massive refactor and probably be nigh impossible as jQuery show/hide and Fomantic-UI depend on them.

[ghost]

Inline scripts are currently necessary for the clone script which we should remove.
Inline styles will be a massive refactor and probably be nigh impossible as jQuery show/hide and Fomantic-UI depend on them.

Right I know this is not easy and I could very well live with inline styles beeing needed for now if inline scripts would go. What botheres me the most is the “unsafe eval” any thoughts on this one ?

[silverwind]

I don't think there is any eval use in the codebase or the dependencies, but IIRC, browser count other things as eval as well, maybe you can get a list of problematic JS call sites.

[ghost]

Indeed good idea I will, I’m at work right know but once I get home I’ll get them listed. Should I post them here ?

[ghost]

But frankly I had to move my gitea installation to an isolated host / server where it will live alone, as I can not live with the potentially security issues I'm facing having the gitea server facing the internet with these drawbacks on Online Security Policy. I'm not blaming anyone just so you know. But the issue is there and it should be fixed if not people in the near future will loose confidence in gitea not trying to be "best in class" :-)

[ghost]

Related to this one

• Branch selector disappear immediately (JS eval function is blocked by CSP) #19851

Indeed it is thnx.

[silverwind]

Let's close in favor of #19851.