CSP exceptions

[timmywil]

miscweb

• script-src: allow 'wasm-unsafe-eval' for WebAssembly-driven search on static sites
  • See pagefind docs for more info. While the Pagefind docs say wasm-unsafe-eval was not yet supported in Safari, it seems to be now, according to MDN and caniuse. I'll double check this after deployment.
  • There is currently a proposal to add a wasm-src attribute with SRI hash validation. We should be able to add that in the future and remove the wasm-unsafe-eval.
• img-src: allow secure.gravatar.com images for the plugins site

grunt

• script-src: add 'unsafe-eval' exception for plugins search
  • the datatables plugin uses jQuery's eval. While later versions of jQuery switched to using script tags for eval, it would still require an unsafe-inline exception. The best solution would be to re-implement search, but that would take time.

Ref #54

[mgol]

• the datatables plugin uses jQuery's eval. While later versions of jQuery switched to using script tags for eval, it would still require an unsafe-inline exception.

How does it work with just unsafe-eval then? unsafe-inline is stronger, but including it would defeat the purpose of using CSP.

[timmywil]

How does it work with just unsafe-eval then?

That's what I was trying to explain. It works because the older jQuery from back when the search was written uses native eval() (and the grunt site is still on an older version of jQuery). New jQuery uses a script tag. The former needs the unsafe-eval exception; the latter needs unsafe-inline. My point was that simply upgrading jQuery doesn't fix the problem (and would require more changes and time anyway). The best fix would be to rewrite the search functionality, so I think the first step is to allow the exception for now until someone can get to the search.

[mgol]

Ah, I didn't notice it was just for the Grunt site.

It's an interesting aspect of our switch of globalEval from indirect eval to an inline script tag - required CSP is actually less secure in the latter.

[timmywil]

required CSP is actually less secure in the latter

yes, in a way. But in defense of the script tag, it allows the user to theoretically set a nonce.

[timmywil]

Squashed/rebased and added an exception for podcast.jquery.com to load media (i.e. podcast audio) from content.jquery.com.