Skip to content

security: remove style-src unsafe-inline #1144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BenjaminMichaelis wants to merge 3 commits into
base: main
Choose a base branch
from
Open

security: remove style-src unsafe-inline #1144

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a73253a
security: remove style-src unsafe-inline
BenjaminMichaelis May 20, 2026
d2e7aff
fix: address CSP review feedback
BenjaminMichaelis May 20, 2026
042c8c7
fix: keep consent UI working under CSP
BenjaminMichaelis May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/TwoFactorAuthentication.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ ViewData["ActivePage"] = ManageNavPages.TwoFactorAuthentication;

if (Model.IsMachineRemembered)
{
<form method="post" style="display: inline-block">
<form method="post" class="d-inline-block">
<button type="submit" class="btn btn-primary">Forget this browser</button>
</form>
}
Expand Down
4 changes: 2 additions & 2 deletions EssentialCSharp.Web/Areas/Identity/Pages/_PasswordStrengthMeter.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@
data-user-input-fields="@Model.UserInputFieldIds"
data-min-length="@EssentialCSharp.Web.Services.PasswordRequirementOptions.PasswordMinimumLength">
<div class="d-flex gap-2 align-items-center">
<div class="progress flex-grow-1" style="height: 6px;" role="progressbar"
<div class="progress flex-grow-1 password-strength-progress" role="progressbar"
aria-label="Password strength"
aria-valuenow="0" aria-valuemin="0" aria-valuemax="100">
<div class="progress-bar password-strength-bar" style="width: 0;"></div>
<div class="progress-bar password-strength-bar password-strength-bar-initial"></div>
</div>
Comment thread
BenjaminMichaelis marked this conversation as resolved.
<button type="button"
class="btn btn-sm btn-outline-secondary password-show-toggle py-0 px-1 border-0"
Expand Down
2 changes: 1 addition & 1 deletion EssentialCSharp.Web/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -508,7 +508,7 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
string csp = string.Join("; ",
$"default-src 'self'",
$"script-src 'self' 'unsafe-inline' cdn.jsdelivr.net www.clarity.ms www.googletagmanager.com js.monitor.azure.com https://hcaptcha.com https://*.hcaptcha.com{tryDotNetSources}",
$"style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com fonts.googleapis.com https://hcaptcha.com https://*.hcaptcha.com",
$"style-src 'self' cdnjs.cloudflare.com fonts.googleapis.com https://hcaptcha.com https://*.hcaptcha.com",
Comment thread
BenjaminMichaelis marked this conversation as resolved.
$"font-src 'self' fonts.gstatic.com cdnjs.cloudflare.com",
$"img-src 'self' data: https:",
$"connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.pwnedpasswords.com https://*.algolia.net https://*.algolianet.com https://*.google-analytics.com https://*.clarity.ms https://*.in.applicationinsights.azure.com{GetApplicationInsightsCspSources(app.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"], app.Logger)}{tryDotNetSources}",
Expand Down
6 changes: 3 additions & 3 deletions EssentialCSharp.Web/Views/Home/About.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
</div>
<div class="col-12 col-md-6">
<div class="d-flex align-items-center justify-content-center h-100 bg-light">
<img src="/images/intellitect-logo.svg" class="img-fluid" alt="IntelliTect Logo" style="height: 75px">
<img src="/images/intellitect-logo.svg" class="img-fluid intellitect-logo-img" alt="IntelliTect Logo">
</div>
</div>
</div>
Expand All @@ -38,7 +38,7 @@
<div class="col-12 col-md-6">
<div class="d-flex align-items-center justify-content-center h-100">
<a href="https://a.co/d/95wxhTg" target="_blank">
<img src="/images/book.png" class="img-fluid" style="height: 450px" alt="Essential C Sharp Book">
<img src="/images/book.png" class="img-fluid ecs-book-cover-img" alt="Essential C Sharp Book">
</a>
</div>
</div>
Expand Down Expand Up @@ -70,4 +70,4 @@
</div>
</div>
</div>
</div>
</div>
12 changes: 6 additions & 6 deletions EssentialCSharp.Web/Views/Home/Guidelines.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
foreach (var guideline in group)
{
<div>
<i class="@GetSymbolForType(guideline.Type)" style="color: @GetColorForType(guideline.Type); padding-right: 10px;"></i>
<i class="@GetSymbolForType(guideline.Type) guideline-icon @GetColorClassForType(guideline.Type)"></i>
<span>@guideline.Guideline</span>
</div>
}
Expand All @@ -75,14 +75,14 @@
};
}

private string GetColorForType(GuidelineType type)
private string GetColorClassForType(GuidelineType type)
{
return type switch
{
GuidelineType.DoNot => "#ff0000",
GuidelineType.Avoid => "#ff0000",
GuidelineType.Consider => "#7a7a7a",
GuidelineType.Do => "#63E6BE",
GuidelineType.DoNot => "guideline-color-do-not",
GuidelineType.Avoid => "guideline-color-avoid",
GuidelineType.Consider => "guideline-color-consider",
GuidelineType.Do => "guideline-color-do",
_ => string.Empty,
};
}
Expand Down
2 changes: 1 addition & 1 deletion EssentialCSharp.Web/Views/Home/Home.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
<div class="col-12 col-md-6">
<div class="d-flex align-items-center justify-content-center h-100">
<a href="https://a.co/d/95wxhTg" target="_blank">
<img src="/images/book.png" class="img-fluid" style="height: 450px" alt="Essential C Sharp Book">
<img src="/images/book.png" class="img-fluid ecs-book-cover-img" alt="Essential C Sharp Book">
</a>
</div>
</div>
Expand Down
15 changes: 2 additions & 13 deletions EssentialCSharp.Web/Views/McpSetup/Index.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
bool isSignedIn = SignInManager.IsSignedIn(User);
}

<div class="container py-4" style="max-width:900px">
<div class="container py-4 mcp-setup-container">


<div class="mb-5">
Expand Down Expand Up @@ -267,7 +267,7 @@
@foreach (var tool in Model)
{
<details class="card mb-2">
<summary class="card-header d-flex align-items-center gap-2" style="cursor:pointer;list-style:none">
<summary class="card-header d-flex align-items-center gap-2 mcp-tool-summary">
<span class="details-chevron">&#9656;</span>
<span class="font-monospace fw-semibold">@tool.Name</span>
Comment thread
BenjaminMichaelis marked this conversation as resolved.
<span class="text-muted small ms-auto">@tool.Title</span>
Expand Down Expand Up @@ -380,17 +380,6 @@
</div>

@section Scripts {
<style>
.details-chevron {
display: inline-block;
transition: transform 0.2s ease;
color: var(--bs-secondary-color, #6c757d);
font-size: .75rem;
}
details[open] > summary .details-chevron {
transform: rotate(90deg);
}
</style>
<script>
function toggleAllTools(btn) {
const details = document.querySelectorAll('#tools details');
Expand Down
2 changes: 1 addition & 1 deletion EssentialCSharp.Web/Views/Shared/_Layout.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@
</div>
</footer>

<div id="docsearch" style="display: none;"></div>
<div id="docsearch" class="d-none"></div>

<script src="~/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
<script src="~/js/algoliaDocSearch.js" asp-append-version="true"></script>
Expand Down
75 changes: 75 additions & 0 deletions EssentialCSharp.Web/wwwroot/css/styles.css
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -786,6 +786,80 @@ details > summary::-webkit-details-marker {
padding-left: 1em;
}

/* CSP inline-style replacements */
.mcp-setup-container {
max-width: 900px;
}

.mcp-tool-summary {
cursor: pointer;
list-style: none;
}

.details-chevron {
display: inline-block;
transition: transform 0.2s ease;
color: var(--bs-secondary-color, #6c757d);
font-size: .75rem;
}

details[open] > summary .details-chevron {
transform: rotate(90deg);
}

.password-strength-progress {
height: 6px;
}

.password-strength-bar-initial {
width: 0;
}

.password-strength-width-20 {
width: 20%;
}

.password-strength-width-40 {
width: 40%;
}

.password-strength-width-60 {
width: 60%;
}

.password-strength-width-80 {
width: 80%;
}

.password-strength-width-100 {
width: 100%;
}

.guideline-icon {
padding-right: 10px;
}

.guideline-color-do-not,
.guideline-color-avoid {
color: #ff0000;
}

.guideline-color-consider {
color: #7a7a7a;
}

.guideline-color-do {
color: #63E6BE;
}

.intellitect-logo-img {
height: 75px;
}

.ecs-book-cover-img {
height: 450px;
}

/* Home Page Styles */

.quote {
Expand Down Expand Up @@ -1079,6 +1153,7 @@ button.accept-policy {
}

/* Reduced motion support */

@media (prefers-reduced-motion: reduce) {
.captcha-modal-overlay,
.captcha-modal-card {
Expand Down
16 changes: 7 additions & 9 deletions EssentialCSharp.Web/wwwroot/js/password-strength.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@
import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';

const SCORE_CONFIG = [
{ label: 'Very weak', barClass: 'bg-danger', width: 20 },
{ label: 'Weak', barClass: 'bg-warning text-dark', width: 40 },
{ label: 'Fair', barClass: 'bg-info text-dark', width: 60 },
{ label: 'Strong', barClass: 'bg-primary', width: 80 },
{ label: 'Very strong', barClass: 'bg-success', width: 100 },
{ label: 'Very weak', barClass: 'bg-danger', width: 20, widthClass: 'password-strength-width-20' },
{ label: 'Weak', barClass: 'bg-warning text-dark', width: 40, widthClass: 'password-strength-width-40' },
{ label: 'Fair', barClass: 'bg-info text-dark', width: 60, widthClass: 'password-strength-width-60' },
{ label: 'Strong', barClass: 'bg-primary', width: 80, widthClass: 'password-strength-width-80' },
{ label: 'Very strong', barClass: 'bg-success', width: 100, widthClass: 'password-strength-width-100' },
];

let zxcvbnReady = false;
Expand Down Expand Up @@ -87,8 +87,7 @@ function updateMeter(container, score, feedback, crackTimesDisplay) {
const crackTimeEl = container.querySelector('.password-strength-cracktime');

// Reset bar classes
bar.className = 'progress-bar password-strength-bar ' + config.barClass;
bar.style.width = config.width + '%';
bar.className = `progress-bar password-strength-bar ${config.barClass} ${config.widthClass}`;

// Update aria
const progressEl = container.querySelector('.progress');
Expand Down Expand Up @@ -126,8 +125,7 @@ function updateMeter(container, score, feedback, crackTimesDisplay) {

function clearMeter(container) {
const bar = container.querySelector('.password-strength-bar');
bar.className = 'progress-bar password-strength-bar';
bar.style.width = '0';
bar.className = 'progress-bar password-strength-bar password-strength-bar-initial';
container.querySelector('.progress').setAttribute('aria-valuenow', '0');
container.querySelector('.password-strength-label').textContent = '';
const warningEl = container.querySelector('.password-strength-warning');
Expand Down
Loading