Uploaded image for project: 'Nuxeo Web UI'
  1. Nuxeo Web UI
  2. WEBUI-1497

CSP should not allow '*' as source for default-src & script-src

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: In Review
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.0.x, 3.1.x
    • Fix Version/s: 3.0.x, 3.1.x
    • Component/s: UI, Web UI

      Description

      • default-src: should not allow '*' as source
      • script-src should not allow '*' as source

      AC

        • CSP policy must keep compatibility with existing applications
          • To be tested with default UI
          • To be tested with a customized UI configured in Nuxeo Studio Designer
            • Specifically check for the import mechanism for which we are using a polyfill to keep compatibility

        Attachments

          Issue Links

          depends on

          Improvement - An improvement or enhancement to an existing feature or task. WEBUI-1282 Allow Content Security Policy without "script-src data:"

          • Major - Major loss of function.
          • In Review
          is related to

          Bug - A problem which impairs or prevents the functions of the product. NXP-32879 NUXEO API Documentation page did not display list of items

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. WEBUI-1575 The content of the spreadsheet popup did not load correctly

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. WEBUI-1579 Clear button in select all functionality shows csp error

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved
          mentioned in

          Page Loading...

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - 1 week, 4 days, 1 hour
                  1w 4d 1h
                  Remaining:
                  Time Spent - 1 day, 6 hours Remaining Estimate - 1 week, 2 days, 2 hours
                  1w 2d 2h
                  Logged:
                  Time Spent - 1 day, 6 hours Remaining Estimate - 1 week, 2 days, 2 hours
                  1d 6h