Security: Content Security Policy Allows Unsafe Inline Styles

[tomaioo]

Summary

Security: Content Security Policy Allows Unsafe Inline Styles

Problem

Severity: Medium | File: resources/html/reactView.html:L12

The CSP in resources/html/reactView.html allows 'unsafe-inline' in style-src and also allows blob:, http:, https:, and data: for styles. This weakens the CSP protection and could allow injection of malicious styles or other content. Additionally, script-src only uses {{cspSource}} without a nonce, which may be insufficient depending on how cspSource is constructed.

Solution

Remove 'unsafe-inline' from style-src if possible, or use a nonce-based approach for styles. Restrict the style-src directive to only necessary sources. Consider adding a nonce to script-src as done in reactWebview.html.

Changes

• resources/html/reactView.html (modified)

---

Rovo Dev code review: Rovo Dev couldn't review this pull request
The pull request author does not have access to Rovo Dev.

[atlassian-cla-bot]

Thank you for your submission! Like many open source projects, we ask that you sign our CLA (Contributor License Agreement) before we can accept your contribution.
If your email is listed below, please ensure that you sign the CLA with the same email address.

The following users still need to sign our CLA:
❌tomaioo

_{Already signed the CLA? To re-check, try refreshing the page.}

[atlassian]

To enable Rovo Dev code reviews, link your GitHub account to your Atlassian account.

This is a one-time task that takes less than a minute. Once your account is linked, resubmit the pull request to trigger a code review.