プロジェクト

全般

プロフィール

Vote #79470

未完了

Support header Content Security Policy

Admin Redmine さんが約4年前に追加. 約4年前に更新.

ステータス:
New
優先度:
通常
担当者:
-
カテゴリ:
Security_51
対象バージョン:
-
開始日:
2022/05/09
期日:
進捗率:

0%

予定工数:
category_id:
51
version_id:
0
issue_org_id:
29405
author_id:
360211
assigned_to_id:
0
comments:
1
status_id:
1
tracker_id:
2
plus1:
0
affected_version:
closed_on:
affected_version_id:
ステータス-->[New]

説明

Hi,

According Google, this a basic Content Security Policy.

Content-Security-Policy: default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'

Redmine crash with it because there is some call to eval in javascript in some pages.

Regards,
Ludovic


journals

Hello

A workaround is to enable all via a *config/initializers/csp.rb*
<pre><code>
Rails.application.config.content_security_policy do |policy|
policy.default_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"
policy.font_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"
policy.img_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"
policy.object_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"
policy.script_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"
policy.style_src "*", :data, :blob, "'unsafe-inline'", "'unsafe-eval'"

# Specify URI for violation reports
# policy.report_uri "/csp-violation-report-endpoint"
end

#Rails.application.config.content_security_policy_report_only = true
</code></pre>
--------------------------------------------------------------------------------

他の形式にエクスポート: Atom PDF

いいね!0
いいね!0