{"action":"created","issue":{"url":"https://api.github.com/repos/YOURLS/YOURLS/issues/2134","repository_url":"https://api.github.com/repos/YOURLS/YOURLS","labels_url":"https://api.github.com/repos/YOURLS/YOURLS/issues/2134/labels{/name}","comments_url":"https://api.github.com/repos/YOURLS/YOURLS/issues/2134/comments","events_url":"https://api.github.com/repos/YOURLS/YOURLS/issues/2134/events","html_url":"https://github.com/YOURLS/YOURLS/issues/2134","id":172328685,"number":2134,"title":"Add support for Content Security Policy","user":{"login":"ScottHelme","id":5352840,"avatar_url":"https://avatars.githubusercontent.com/u/5352840?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottHelme","html_url":"https://github.com/ScottHelme","followers_url":"https://api.github.com/users/ScottHelme/followers","following_url":"https://api.github.com/users/ScottHelme/following{/other_user}","gists_url":"https://api.github.com/users/ScottHelme/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottHelme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottHelme/subscriptions","organizations_url":"https://api.github.com/users/ScottHelme/orgs","repos_url":"https://api.github.com/users/ScottHelme/repos","events_url":"https://api.github.com/users/ScottHelme/events{/privacy}","received_events_url":"https://api.github.com/users/ScottHelme/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-08-21T16:30:19Z","updated_at":"2016-08-29T19:53:52Z","closed_at":null,"body":"[Content Security Policy](https://scotthelme.co.uk/content-security-policy-an-introduction/) is a modern browser security feature and support for using CSP in YOURLS would be a significant step forwards.\r\n\r\nThe biggest problem for deploying CSP in YOURLS right now is that there are several inline scripts in pages that means the 'unsafe-inline' keyword is required in a CSP, vastly reducing the protection offered. Inline script tags are injected into pages in many locations such as:\r\n\r\nhttps://github.com/YOURLS/YOURLS/blob/master/includes/functions-html.php#L871\r\n\r\nIf these scripts could be externalised then deploying CSP in YOURLS would require minimal additional effort as content is loaded from the host. For testing purpose you can issue the following HTTP response header to configure CSP:\r\n\r\n    Content-Security-Policy-Report-Only: default-src 'self'\r\n\r\nThis header will not have any negative effects as it is report only mode, check the console as you navigate the site for errors. I'm happy to provide input where needed!"},"comment":{"url":"https://api.github.com/repos/YOURLS/YOURLS/issues/comments/243235561","html_url":"https://github.com/YOURLS/YOURLS/issues/2134#issuecomment-243235561","issue_url":"https://api.github.com/repos/YOURLS/YOURLS/issues/2134","id":243235561,"user":{"login":"ScottHelme","id":5352840,"avatar_url":"https://avatars.githubusercontent.com/u/5352840?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottHelme","html_url":"https://github.com/ScottHelme","followers_url":"https://api.github.com/users/ScottHelme/followers","following_url":"https://api.github.com/users/ScottHelme/following{/other_user}","gists_url":"https://api.github.com/users/ScottHelme/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottHelme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottHelme/subscriptions","organizations_url":"https://api.github.com/users/ScottHelme/orgs","repos_url":"https://api.github.com/users/ScottHelme/repos","events_url":"https://api.github.com/users/ScottHelme/events{/privacy}","received_events_url":"https://api.github.com/users/ScottHelme/received_events","type":"User","site_admin":false},"created_at":"2016-08-29T19:53:52Z","updated_at":"2016-08-29T19:53:52Z","body":"@LeoColomb you could do this using the nonce mechanism quite easily without rewriting any code. All you need to do is insert the nonce into the CSP header and then inject the nonce attribute into script tags :+1: "}}
{"actor":{"display_login":"ScottHelme"}}