CSP declaration in meta tag ignored
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 42/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
Research direction
Reproduce the issue with an HTML page containing a Content-Security-Policy meta tag, then trace the CSP detection used by Coach. The fix is complete when CSP declarations in the HTML source are recognized and the contentSecurityPolicyHeader advice is no longer shown for that page.
Written by the indexing model from the issue text.
Description
Using latest docker image of Sitespeed (sitespeedio/sitespeed.io:latest), Coach attempts to detect CSP headers (https://github.com/sitespeedio/coach/pull/315), but CSP declarations in the html source are ignored.
How to check? Create a page with CSP specified in a meta tag ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#Examples ):
<!doctype html>
<html lang="en">
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self' *.domain.com;">
</head>
<body>
...
Then run Sitespeed and you'll still get the advice: Use a good Content-Security-Policy header to make sure you you avoid Cross Site Scripting (XSS) attacks. (contentSecurityPolicyHeader)
- Dominant language
- JavaScript
- Stars
- 3
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sitespeedio/coach-core
-
Difficulty 3/5 1-2 days Newbie friendliness 30/100
sitespeedio/coach-core#136 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
sitespeedio/coach-core#134 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
sitespeedio/coach-core#112 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
sitespeedio/coach-core#103 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
sitespeedio/coach-core#86 · 1 comment ·
All issues in sitespeedio/coach-core
Similar issues
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
TanbirRamim/open-source-radar#353 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 2 days
-
design-review mac P3 ui
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
tosunlab/hisarapp-core#502 ·
-
enhancement status: needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
mastra-ai/mastra#28651 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement frontend help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
nikhilb2/simple_invoicing#470 ·
Maintainers usually reply within 1 day