Replies: 0
Hi,
I recently enabled the CSP (Content Security Policy) on my blog and one of the directives I’m using is script-src. I’m blocking the execution of scripts from everywhere except ‘self’ and a couple additional domains like stats.wp.com.
The thing is that when enabled I found that Jetpack is adding some inline scripts to my pages, like the following ones:
<script>
document.addEventListener('DOMContentLoaded', function () {
var commentForms = document.getElementsByClassName('jetpack_remote_comment');
for (var i = 0; i < commentForms.length; i++) {
commentForms[i].allowTransparency = false;
commentForms[i].scrolling = 'no';
}
});
</script>
<script type="text/javascript">
window.WPCOM_sharing_counts = {"https:\/\/blog.pablofain.com\/2018\/12\/19\/como-evitar-ser-victimas-de-phishing\/":5393};
</script>
<script type='text/javascript'>
/* <![CDATA[ */
var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":"1"};
/* ]]> */
</script>
The sharing buttons, for example:
<script type='text/javascript'>
var windowOpen;
jQuery( document.body ).on( 'click', 'a.share-facebook', function() {
// If there's another sharing window open, close it.
if ( 'undefined' !== typeof windowOpen ) {
windowOpen.close();
}
windowOpen = window.open( jQuery( this ).attr( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' );
return false;
});
var windowOpen;
jQuery( document.body ).on( 'click', 'a.share-linkedin', function() {
// If there's another sharing window open, close it.
if ( 'undefined' !== typeof windowOpen ) {
windowOpen.close();
}
windowOpen = window.open( jQuery( this ).attr( 'href' ), 'wpcomlinkedin', 'menubar=1,resizable=1,width=580,height=450' );
return false;
});
var windowOpen;
jQuery( document.body ).on( 'click', 'a.share-twitter', function() {
// If there's another sharing window open, close it.
if ( 'undefined' !== typeof windowOpen ) {
windowOpen.close();
}
windowOpen = window.open( jQuery( this ).attr( 'href' ), 'wpcomtwitter', 'menubar=1,resizable=1,width=600,height=350' );
return false;
});
var windowOpen;
jQuery( document.body ).on( 'click', 'a.share-pocket', function() {
// If there's another sharing window open, close it.
if ( 'undefined' !== typeof windowOpen ) {
windowOpen.close();
}
windowOpen = window.open( jQuery( this ).attr( 'href' ), 'wpcompocket', 'menubar=1,resizable=1,width=450,height=450' );
return false;
});
</script>
Above mentioned scripts -plus another ones- are being blocked by the browsers because of the CSP directives. I could prevent this by adding “unsafe-inline” to the list of allowed directives, but this is definitely making CSP pointless.
Is it possible for you to move this code out-of-line?
Thanks,
Pablo