{"action":"opened","issue":{"url":"https://api.github.com/repos/torchbox/wagtail/issues/1288","labels_url":"https://api.github.com/repos/torchbox/wagtail/issues/1288/labels{/name}","comments_url":"https://api.github.com/repos/torchbox/wagtail/issues/1288/comments","events_url":"https://api.github.com/repos/torchbox/wagtail/issues/1288/events","html_url":"https://github.com/torchbox/wagtail/issues/1288","id":75244803,"number":1288,"title":"CSP policy directives issues","user":{"login":"salvadormrf","id":976893,"avatar_url":"https://avatars.githubusercontent.com/u/976893?v=3","gravatar_id":"","url":"https://api.github.com/users/salvadormrf","html_url":"https://github.com/salvadormrf","followers_url":"https://api.github.com/users/salvadormrf/followers","following_url":"https://api.github.com/users/salvadormrf/following{/other_user}","gists_url":"https://api.github.com/users/salvadormrf/gists{/gist_id}","starred_url":"https://api.github.com/users/salvadormrf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salvadormrf/subscriptions","organizations_url":"https://api.github.com/users/salvadormrf/orgs","repos_url":"https://api.github.com/users/salvadormrf/repos","events_url":"https://api.github.com/users/salvadormrf/events{/privacy}","received_events_url":"https://api.github.com/users/salvadormrf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-11T14:39:58Z","updated_at":"2015-05-11T14:39:58Z","closed_at":null,"body":"I have enabled Content Security Policy (CSP) directives on wagtail admin using django-csp.\r\nCSP is not required for all websites but for some clients is mandatory as part of the security requirements.\r\n\r\nHere is a list of issues I have found by enabling CSP on wagtail admin.\r\n- use of inline script (<script>createDocumentChooser(\"body-2-value-document\");</script>)\r\n- use of inline style (<div class=\"focal-point-chooser\" style=\"max-width: 400px;...;\")\r\n- use of javascript eval (In Modal choosers)\r\n- gravatar images being loaded\r\n\r\n\r\nI tried to override all templates where inline scripts were being used to add \"nonce\" attribute.\r\n- However widgets generate the <script> tags and they don't have access to request to access request context variables. \r\n\r\nI tried to set \"nonce\" attribute on inline scripts is to wrap the whole base.html with a custom django template tag. Beautifulsoup parses all HTML nodes for script tags and sets the nonce attribute. This approach assumes that all html content being rendered is always safe.\r\n\r\nThe modal use javascript eval, and at the end was to many files being changed. \r\nSo I had be more flexible with the CSP directives (less secure) in order to keep everything working fine on wagtail admin.\r\n\r\nWould be nice while developing wagtail that CSP could be taken into consideration, and where it is possible to try to avoid inline styles and scripts unless there is a proper way to mark it as safe.\r\n\r\nThanks!\r\nI am enjoying even more wagtail as I use it  for development :)\r\n\r\n\r\n\r\n"}}