0

I have a webpage hosted on jenkins server.

I saw that in the latest jenkins update there was

So I have read this fantastic post on how to bypass this restriction

I have added this <meta> to my page

but i keep on getting console errors:

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' https://maxcdn.bootstrapcdn.com/bootstrap/". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.

    <head>
<title>Bidi: unknown bl version vs. 1.0.487</title>
<meta content="text/html; charset=utf-8 ;" http-equiv="content-type">
<meta content="style-src 'self' https://maxcdn.bootstrapcdn.com/bootstrap/" http-equiv="Content-Security-Policy"><meta content="script-src 'self' https://maxcdn.bootstrapcdn.com/bootstrap/" http-equiv="Content-Security-Policy"><meta content="default-src 'self' https://maxcdn.bootstrapcdn.com/bootstrap/" http-equiv="Content-Security-Policy"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap-theme.min.css"><script type="script" src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js"></script><link rel="icon" href="/jenkins/view/QA/job/RoutingRegression/ws/src/main/resources/html_pages/images/favicon.png" type="image/gif" sizes="16x16"><link rel="stylesheet" href="/RoutingRegression/html_pages/css/delta_samples.css">
</head>

enter image description here

Community
  • 1
  • 1
Elad Benda
  • 35,076
  • 87
  • 265
  • 471

2 Answers2

0

Add 'unsafe-inline' attribute to the metadata.

<meta content="style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/" http-equiv="Content-Security-Policy">
<meta content="script-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/" http-equiv="Content-Security-Policy">
Neha Singh
  • 63
  • 1
  • 3
-1

I think you should read this fantastic post I fully relaxed my Jenkins config by using

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "")

whitediver
  • 462
  • 3
  • 12
  • To be clear, "fully relaxed my Jenkins config" means "**entirely disabled `Content-Security-Policy`**", potentially exposing your system to [Cross-Site Scripting](https://owasp.org/www-community/attacks/xss/) attacks. A more nuanced, tailored [Content Security Policy](https://content-security-policy.com/) should be considered – Ian W May 25 '22 at 08:44