Re: [PATCH] Duplicate base css definitions in stylesheets

[Konstantin Ryabitsev <konstantin@linuxfoundation.org>]

On Mon, Aug 16, 2021 at 10:21:48PM +0000, Eric Wong wrote:
> > However, site security policies may deliberately prohibit execution of
> > inline content such as scripts and stylesheets as an extra layer of
> > protection against XSS vulnerabilities. For example, with the following
> > HTTP headers returned by the server, the inline styles above will be
> > ignored:
> > 
> >     Content-Security-Policy: default-src 'self'
> 
> Odd, I thought inline would be the most secure since there's no
> chance of separate requests going to third parties...

For sites that accept untrusted user input (e.g. via query boxes or any other
input), default-src 'self' is the safest setting, because this requires an
attacker to be able to inject both a server-side entry that returns malicious
content *and* an in-page link, script, or img tag that would load it. It helps
eliminate reflected XSS as an attack vector entirely.

> > This causes public-inbox content to be rendered poorly on mobile devices
> > due to the default <pre> behaviour. Duplicating this declaration into
> > the contrib stylesheets makes sure that these styles are applied even
> > with the strictest security policies in place.
> 
> Oh well :<   pushed as commit 86df4acd140d61ab2f82e8c17e3118865f867c9a

Thank you!

-K