{"push_id":550803801,"size":1,"distinct_size":1,"ref":"refs/heads/remove-inline-javascript","head":"be8a401dc476bdabe98486d56cea0e6b8f6d9446","before":"7c6c99edccfe8fbd771941319ad59fd296b54551","commits":[{"sha":"be8a401dc476bdabe98486d56cea0e6b8f6d9446","author":{"email":"173e4baf7722781318c4f9ba6b90abd8874b8258@digital.cabinet-office.gov.uk","name":"Alex Muller"},"message":"Remove inline JavaScript from the template\n\nWe'd like to enable Content Security Policy on GOV.UK, which provides\nadditional security against cross-site scripting and other vulnerabilities\nin the site.\n\nAs part of this, we need to set an HTTP header to instruct the browser\nto not execute any JavaScript that it encounters in <script> tags\non the page.\n\nThis is to defend against cases where somebody exploits GOV.UK and\nwe are not adequately protected against script tags injected in the\npage by other means eg by a malicious author in a content\nmanagement system.\n\nThis commit moves inline JavaScript into asset files that can be\nloaded from a whitelisted domain.\n\nThis commit has issues and should not be merged to master. If you're\nreading this on master in the future, sorry. The ERB in ie-8.js is\nnot processed. Also, this will cause an extra 3 HTTP requests which\nit would be good to mitigate if possible.","distinct":true,"url":"https://api.github.com/repos/alphagov/govuk_template/commits/be8a401dc476bdabe98486d56cea0e6b8f6d9446"}]}