[TOBAGO-1171] Support for the Content Security Policy (CSP)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-alpha-3, 2.0.0
• Component/s: Themes
• Assignee: Udo Schnurpfeil
• Reporter: Udo Schnurpfeil
• Created: 04/Jul/12 12:29
• Updated: 07/Jan/14 14:36
• Resolved: 03/Jan/14 17:41

Description

This is to prevent cross-site scripting (XSS) and related attacks.

More about this security feature you can found at W3 http://www.w3.org/TR/CSP/

Main work is to remove all JavaScript from the HTML code, see also the sub-tasks.

Issue Links

• is blocked by: TOBAGO-1192 buttons and links rendering without javascript fragments
• is blocked by: TOBAGO-1258 New attribute "omit" for commands
• is blocked by: TOBAGO-1260 Input-Suggest doesn't support CSP
• is blocked by: TOBAGO-1187 new tag tc:dataAttribute for HTML5 data-*
• is blocked by: TOBAGO-1184 Support for initializing components without javascript fragments
• is related to: TOBAGO-1310 Support for the CSP header field: Content-Security-Policy-Report-Only
• relates to: TOBAGO-1188 Mark onclick and other on* attributes as deprecated