{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/1794","repository_url":"https://api.github.com/repos/mozilla/testpilot","labels_url":"https://api.github.com/repos/mozilla/testpilot/issues/1794/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/testpilot/issues/1794/comments","events_url":"https://api.github.com/repos/mozilla/testpilot/issues/1794/events","html_url":"https://github.com/mozilla/testpilot/pull/1794","id":188375945,"number":1794,"title":"[ref #904] Add directives to 'script-src'","user":{"login":"ckprice","id":8632184,"avatar_url":"https://avatars.githubusercontent.com/u/8632184?v=3","gravatar_id":"","url":"https://api.github.com/users/ckprice","html_url":"https://github.com/ckprice","followers_url":"https://api.github.com/users/ckprice/followers","following_url":"https://api.github.com/users/ckprice/following{/other_user}","gists_url":"https://api.github.com/users/ckprice/gists{/gist_id}","starred_url":"https://api.github.com/users/ckprice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckprice/subscriptions","organizations_url":"https://api.github.com/users/ckprice/orgs","repos_url":"https://api.github.com/users/ckprice/repos","events_url":"https://api.github.com/users/ckprice/events{/privacy}","received_events_url":"https://api.github.com/users/ckprice/received_events","type":"User","site_admin":false},"labels":[{"id":253958633,"url":"https://api.github.com/repos/mozilla/testpilot/labels/status:%20in%20progress","name":"status: in progress","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-09T23:05:27Z","updated_at":"2016-11-10T18:10:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/testpilot/pulls/1794","html_url":"https://github.com/mozilla/testpilot/pull/1794","diff_url":"https://github.com/mozilla/testpilot/pull/1794.diff","patch_url":"https://github.com/mozilla/testpilot/pull/1794.patch"},"body":"- add app.optimizely.com to `script-src`\r\n- ~~add `unsafe-inline` and `unsafe-eval` to `script-src`~~ \r\n- add `unsafe-inline` to `style-src`\r\n\r\nRef #904.\r\n\r\nCloser! I'm reading console errors from [the Optimizely dashboard now](https://cloud.githubusercontent.com/assets/8632184/20158107/58c3875e-a68d-11e6-88d1-5583b601c8c7.png). Additions are based on [these recommendations](https://help.optimizely.com/Troubleshoot_Problems/Update_your_site's_Content_Security_Policies_(CSP)#2._Script).\r\n"},"comment":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/comments/259763995","html_url":"https://github.com/mozilla/testpilot/pull/1794#issuecomment-259763995","issue_url":"https://api.github.com/repos/mozilla/testpilot/issues/1794","id":259763995,"user":{"login":"ckprice","id":8632184,"avatar_url":"https://avatars.githubusercontent.com/u/8632184?v=3","gravatar_id":"","url":"https://api.github.com/users/ckprice","html_url":"https://github.com/ckprice","followers_url":"https://api.github.com/users/ckprice/followers","following_url":"https://api.github.com/users/ckprice/following{/other_user}","gists_url":"https://api.github.com/users/ckprice/gists{/gist_id}","starred_url":"https://api.github.com/users/ckprice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckprice/subscriptions","organizations_url":"https://api.github.com/users/ckprice/orgs","repos_url":"https://api.github.com/users/ckprice/repos","events_url":"https://api.github.com/users/ckprice/events{/privacy}","received_events_url":"https://api.github.com/users/ckprice/received_events","type":"User","site_admin":false},"created_at":"2016-11-10T18:10:24Z","updated_at":"2016-11-10T18:10:24Z","body":"Thanks. I've updated this PR to take out the unsafe stuff from `script-src`, and will open a follow-up issue (and keep this context) if required.\r\n\r\n> I'm less concerned about unsafe-inline style-src. \r\n\r\nI kept the update to `style-src`.\r\n\r\nThe reason I added these in the first place is because CSP is reporting a violation that mentioned `eval()` at https://testpilot.dev.mozaws.net/\r\n\r\n```\r\n\"script-sample\":\"call to eval() or related function blocked by CSP\",\r\n\"violated-directive\":\"script-src https://testpilot.dev.mozaws.net https://pontoon.mozilla.org https://ssl.google-analytics.com https://cdn.optimizely.com\"\r\n```\r\n\r\nI may be misinterpreting this report and maybe we don't need the unsafe stuff. But again, I can only test the Optimizely dashboard on dev so won't know until we're merged :/ r? @lmorchard @g-k\r\n"}}
{"actor":{"display_login":"ckprice"}}