Prevent CSP violations by not having script URLs #4062
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arikfr
commented
Aug 12, 2019
| @@ -173,6 +173,7 @@ body { | |||
|
|
|||
| &:hover, &:focus { | |||
| color: @yellow-darker; | |||
| cursor: pointer; | |||
There was a problem hiding this comment.
@ranbena this adds some work for #4017... Sorry, but @gabrieldutra is right: we can YOLO it, but only after V8 branch is cut.
kravets-levko
approved these changes
Aug 12, 2019
|
Thank you @arikfr! |
harveyrendell
pushed a commit
to pushpay/redash
that referenced
this pull request
Nov 14, 2019
* Fix: remove inline script to avoid CSP violation Closes getredash#4039. * Restore eslint rule that prevents javascript href attributes. * Remove all inline script links.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this? (check all applicable)
Description
Following the discovery in #4039 I searched the code for further locations of where we use this pattern and removed them all. I also restored the lint rule to prevent future cases.
We should probably use
<Button type="link" ...>in the future instead of<a>tags in such cases, but didn't want to work around the styling issues so kept things as is.