Jenkins Content Security Policy
<p>I'm confused about Jenkins Content Security Policy.</p>

<p>I know these sites:</p>

<ul>
<li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy" rel="noreferrer">Configuring Content Security Policy</a></li>
<li><a href="http://content-security-policy.com/" rel="noreferrer">Content Security Policy Reference</a> </li>
</ul>

<p>I have a html page shown via Jenkins Clover Plugin. This html page uses inline style, e.g.:</p>

<pre><code>&lt;div class='greenbar' style='width:58px'&gt;
</code></pre>

<p>The div-element visualizes a progressbar.
Using the default Jenkins CSP configuration leads to the following result:
<a href="http://i.stack.imgur.com/3Jr1h.png" rel="noreferrer">Progressbar_FAIL</a></p>

<p>The result i want to have looks like this:
<a href="http://i.stack.imgur.com/1cXuv.png" rel="noreferrer">Progressbar_WORKS</a></p>

<p>I tried to relax the CSP rules, adding different combinations of parameters (script-src, style-src) with different levels (self, unsafe-inline,..) but nothing works.</p>

<p>So my questions for now:</p>

<ol>
<li>Where do i have to specify the CSP configuration? </li>
<li>Is it possible to use inline styles? </li>
<li>Where should the styles be located? My css-stylesheets are located local on the Jenkins Server. </li>
<li>What is the best way to get inline style and CSP rules "satisfied"</li>
</ol>

<p><strong>Update</strong> </p>

<p><strong>1. Try:</strong>
<code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'</code> 
in the jenkins.xml file. Then the following error occurs:                </p>

<blockquote>
  <p>Refused to apply inline style because it violates the following
  Content Security Policy directive: "default-src 'self'". Either the
  'unsafe-inline' keyword, a hash ('sha256-'), or a nonce
  ('nonce-...') is required to enable inline execution. Note also that
  'style-src' was not explicitly set, so 'default-src' is used as a
  fallback.</p>
</blockquote>

<p><strong>2. Try</strong>
<code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'; style-src 'self'</code> in the jenkins.xml file. Then the following error occurs:   </p>

<blockquote>
  <p>Refused to apply inline style because it violates the following
  Content Security Policy directive: "style-src 'self'". Either the
  'unsafe-inline' keyword, a hash
  ('sha256-'), or a nonce
  ('nonce-...') is required to enable inline execution</p>
</blockquote>

<p>I understand that this try can not solve my problem, because default-src includes style-src</p>

<p><strong>3. Try</strong>
<code>-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'; style-src 'unsafe-inline'</code> in the jenkins.xml file. Then the following error occurs: </p>

<blockquote>
  <p>Refused to load the stylesheet
  s://jenkins/andsomedir/stylesheet.css [its https://... not allowed to post more than two links :(]
  because it violates the following Content Security Policy directive:
  "style-src 'unsafe-inline'".</p>
</blockquote>