security headers - remove `unsafe-eval` from content security policy
-
identify content which triggers the need for unsafe-eval
scripts -
file issues to have that scripts content updated to be "safe" -
remove CSP header designation unsafe-eval
from WWW front end such as HAProxy
re:
Content-Security-Policy object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://gl-static.global.ssl.fastly.net https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://gl-static.global.ssl.fastly.net; img-src * data: blob:; frame-src 'self' https://www.google.com/recaptcha/; frame-ancestors 'self'; connect-src 'self' https://gl-static.global.ssl.fastly.net wss://gitlab.com https://sentry.gitlap.com https://customers.gitlab.com; report-uri https://sentry-infra.gitlap.com/api/3/csp-report/?sentry_key=a664fdde83424b43a991f25fa7c78987
which was retrieved 2017-10-12 from https://gitlab.com/dashboard