ciphera-net/pulse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

Release 0.13.0-alpha #39

Merged
uz1mani merged 22 commits from staging into main 2026-03-02 22:51:53 +00:00
Conversation 3 Commits 22 Files Changed 35 +75 -667
16 changed files with 75 additions and 667 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit fba1fd99c2 - Show all commits

2
next.config.ts
View File

@@ -14,7 +14,7 @@ const cspDirectives = [
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob: https://www.google.com https://*.gstatic.com https://ciphera.net",
"font-src 'self'",
`connect-src 'self' https://*.ciphera.net https://cdn.jsdelivr.net${process.env.NODE_ENV === 'development' ? ' http://localhost:*' : ''}`,
`connect-src 'self' https://*.ciphera.net https://ciphera.net https://www.google.com https://*.gstatic.com https://cdn.jsdelivr.net${process.env.NODE_ENV === 'development' ? ' http://localhost:*' : ''}`,
"worker-src 'self'",
"frame-src 'none'",
greptile-apps[bot] commented 2026-03-02 22:55:47 +00:00 (Migrated from github.com)
Review
Copy Link

'unsafe-inline' in production script-src neutralises XSS protection

The comment acknowledges this is required for Next.js bootstrap scripts, but browsers ignore the entire script-src allowlist when 'unsafe-inline' is present (unless a nonce or hash is also provided). This means the script-src 'self' restriction has no effect in production — any inline script injected by an attacker will execute freely.

The recommended approach for Next.js is to use a per-request nonce (via generateBuildId / middleware) and emit script-src 'nonce-{value}' rather than 'unsafe-inline'. That is non-trivial to set up, but as long as 'unsafe-inline' is present the script-src directive is essentially no-op from a security standpoint. At a minimum, this is worth a code comment so future contributors don't assume XSS protection is in force.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: next.config.ts
Line: 16

Comment:
**`'unsafe-inline'` in production `script-src` neutralises XSS protection**

The comment acknowledges this is required for Next.js bootstrap scripts, but browsers ignore the entire `script-src` allowlist when `'unsafe-inline'` is present (unless a nonce or hash is also provided). This means the `script-src 'self'` restriction has no effect in production — any inline script injected by an attacker will execute freely.

The recommended approach for Next.js is to use a per-request nonce (via `generateBuildId` / middleware) and emit `script-src 'nonce-{value}'` rather than `'unsafe-inline'`. That is non-trivial to set up, but as long as `'unsafe-inline'` is present the `script-src` directive is essentially no-op from a security standpoint. At a minimum, this is worth a code comment so future contributors don't assume XSS protection is in force.

How can I resolve this? If you propose a fix, please make it concise.
**`'unsafe-inline'` in production `script-src` neutralises XSS protection** The comment acknowledges this is required for Next.js bootstrap scripts, but browsers ignore the entire `script-src` allowlist when `'unsafe-inline'` is present (unless a nonce or hash is also provided). This means the `script-src 'self'` restriction has no effect in production — any inline script injected by an attacker will execute freely. The recommended approach for Next.js is to use a per-request nonce (via `generateBuildId` / middleware) and emit `script-src 'nonce-{value}'` rather than `'unsafe-inline'`. That is non-trivial to set up, but as long as `'unsafe-inline'` is present the `script-src` directive is essentially no-op from a security standpoint. At a minimum, this is worth a code comment so future contributors don't assume XSS protection is in force. <details><summary>Prompt To Fix With AI</summary> `````markdown This is a comment left during a code review. Path: next.config.ts Line: 16 Comment: **`'unsafe-inline'` in production `script-src` neutralises XSS protection** The comment acknowledges this is required for Next.js bootstrap scripts, but browsers ignore the entire `script-src` allowlist when `'unsafe-inline'` is present (unless a nonce or hash is also provided). This means the `script-src 'self'` restriction has no effect in production — any inline script injected by an attacker will execute freely. The recommended approach for Next.js is to use a per-request nonce (via `generateBuildId` / middleware) and emit `script-src 'nonce-{value}'` rather than `'unsafe-inline'`. That is non-trivial to set up, but as long as `'unsafe-inline'` is present the `script-src` directive is essentially no-op from a security standpoint. At a minimum, this is worth a code comment so future contributors don't assume XSS protection is in force. How can I resolve this? If you propose a fix, please make it concise. ````` </details>
"object-src 'none'",