Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do the work to remove 'unsafe-eval' from CSP for script-src #1679

Closed
miketaylr opened this issue Jul 26, 2017 · 0 comments
Closed

Do the work to remove 'unsafe-eval' from CSP for script-src #1679

miketaylr opened this issue Jul 26, 2017 · 0 comments
Assignees
@miketaylr
Labels
status: in progress type: security

Comments

@miketaylr
Copy link
Member

The blocker is using lodash templates. I have a plan to do pre-compiled template functions, which should let us maybe even reduce the size of our lodash build we send over the wire (since we won't need template parsing).
@miketaylr miketaylr self-assigned this Jul 26, 2017
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Add grunt-contrib-jst dependency to package.json
2fdbef4
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Add jst grunt task and generate a templates.js as a result.
6945502
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Move inline templates into their own files, and import t…
64123cc 
…hem accordingly.
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Handle authenticated check via JS.
2c9043d
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Inline html includes into jst templates, and remove redu…
4c521f5 
…ndant files as a result.

Unfortunately the pre-compiled template approach won't let us rely on the jinja2 parser
to do interesting things with JS templates.
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. DRY: the diagnosis section of the homepage, and both sec…
1088cd6 
…tions of my issues should use the same issue template.
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Rename tmpl to jst (to match configs), and use shorter p…
f7ef9ac 
…ath for convenience.
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Remove 'unsafe-eval' from script-src directive of CSP po…
2df8883 
…licy.
miketaylr pushed a commit that referenced this issue Jul 27, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
36e636d
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
1c5bb2d
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Update dev-env-setup.md to mention the need to re-build …
bac9ef4 
…after modifying .jst templates.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Add jst grunt task and generate a templates.js as a result.
1487bc8
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Move inline templates into their own files, and import t…
a16cf87 
…hem accordingly.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Handle authenticated check via JS.
0f9c940
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Inline html includes into jst templates, and remove redu…
2bb5aea 
…ndant files as a result.

Unfortunately the pre-compiled template approach won't let us rely on the jinja2 parser
to do interesting things with JS templates.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. DRY: the diagnosis section of the homepage, and both sec…
5c9124b 
…tions of my issues should use the same issue template.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Rename tmpl to jst (to match configs), and use shorter p…
5cd6d75 
…ath for convenience.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Remove 'unsafe-eval' from script-src directive of CSP po…
7f8befe 
…licy.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
daed39e
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Update dev-env-setup.md to mention the need to re-build …
98a5ba4 
…after modifying .jst templates.
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
843ca70
miketaylr pushed a commit that referenced this issue Jul 28, 2017
Issue #1679. Update dev-env-setup.md to mention the need to re-build …
b54168a 
…after modifying .jst templates.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
abc0f88
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Update dev-env-setup.md to mention the need to re-build …
aa6e98d 
…after modifying .jst templates.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Add grunt-contrib-jst dependency to package.json
260c05b
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Add jst grunt task and generate a templates.js as a result.
ed3f430
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Move inline templates into their own files, and import t…
0e510cf 
…hem accordingly.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Handle authenticated check via JS.
2aa9490
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Inline html includes into jst templates, and remove redu…
5206012 
…ndant files as a result.

Unfortunately the pre-compiled template approach won't let us rely on the jinja2 parser
to do interesting things with JS templates.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. DRY: the diagnosis section of the homepage, and both sec…
e0cf9c4 
…tions of my issues should use the same issue template.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Rename tmpl to jst (to match configs), and use shorter p…
727f56a 
…ath for convenience.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Remove 'unsafe-eval' from script-src directive of CSP po…
5f4df15 
…licy.
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Move subTemplate inline template into its own jst file.
a28e01d
miketaylr pushed a commit that referenced this issue Jul 31, 2017
Issue #1679. Update dev-env-setup.md to mention the need to re-build …
fa64824 
…after modifying .jst templates.
miketaylr pushed a commit that referenced this issue Aug 1, 2017
Issue #1679. Add external .jst template for showThanks flash message.
697d8b5
@karlcow karlcow mentioned this issue Aug 2, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@miketaylr miketaylr

Labels
status: in progress type: security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@miketaylr