Content-Security-Policy on sourceware.org breaking HTML manuals

[Mike Frysinger <vapier@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1891 bytes --]

tl;dr: can we add "; style-src 'unsafe-inline' http: https:" to sourceware.org's CSP header ?

it seems a CSP header has been added to the sourceware.org web server at
some point and it breaks inline <style> in web pages.  it breaks inline
<script> too, but that's prob for the best, and i'm not aware of cases
that are affected by this.

$ curl --HEAD https://sourceware.org/
HTTP/2 200
date: Mon, 25 Dec 2023 01:03:04 GMT
server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k mod_qos/11.74 mod_wsgi/4.6.4 Python/3.6 mod_perl/2.0.12 Perl/v5.26.3
accept-ranges: bytes
vary: Accept-Encoding
content-security-policy: default-src 'self' http: https:
strict-transport-security: max-age=16070400
content-type: text/html; charset=UTF-8

unfortunately, inline <style> is used in all HTML manuals generated by
GNU texinfo.  you can see this by visiting the GDB manual:
	https://sourceware.org/gdb/current/onlinedocs/gdb.html/

Chrome's devtools will show the warning:
> Refused to apply inline style because it violates the following Content Security Policy directive:
> "default-src 'self' http: https:". Either the 'unsafe-inline' keyword, a hash ('...'), or a
> nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not
> explicitly set, so 'default-src' is used as a fallback.

should we allow inline <style> for now on sourceware.org until we figure
out something better ?  i think it would just be:
	default-src 'self' http: https:; style-src 'unsafe-inline' http: https:

i grok that this disables one XSS protection, but i suspect its not a huge
concern for us ... we have bugzilla & wiki which hosts user-submitted content,
but the wiki at least is "trusted" devs, and bugzilla is normally programmed
with this stuff in mind.

a lot of these manuals are historical and would need manual regeneration
or hacking to use an external sheet.
-mike

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]