1571346 - Remove 'unsafe-inline' from style-src within about:addons

Status: NEW

(Toolkit :: Add-ons Manager, task, P3)

Description

[Christoph Kerschbaumer [:ckerschb]]

Within Bug 1497189 we are adding a CSP to about:addons. Most importantly is to block any inline script that runs but as a follow up we should also eliminate all usages of inline styles. After the removals of inline styles, e.g:

• https://searchfox.org/mozilla-central/rev/b3fd653bc6078b3be4a8d06db39eddc5714755da/toolkit/mozapps/extensions/content/message-bar.js#62
• https://searchfox.org/mozilla-central/rev/b3fd653bc6078b3be4a8d06db39eddc5714755da/toolkit/mozapps/extensions/content/message-bar.js#103

we should be able to remove 'unsafe-inline' from style-src for about:addons.

Comment 1

[Frederik Braun [:freddy]]

Attachment: Bug 1571346 - Remove unsafe-inline style-src directive in aboutaddons r?mixedpuppy

It seems the originally problematic code is no longer existing.

Comment 2

[Frederik Braun [:freddy]]

Looks like there are still some files that are a bit harder to nail down. The reporting just says "chrome" without further URL info. Meh.