Merge branch 'remove-unsafe-inline' into 'master'

Remove unsafe-inline from CSP

See merge request framasoft/mobilizon!974

lib/web/plugs/http_security_plug.ex

@@ -51,8 +51,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
   # Connect-src is available for any origin (*) because of webfinger query to redirect to content
   @connect_src "connect-src 'self' * blob: "
   # unsafe-eval is because of JS issues with regenerator-runtime
-  # unsafe-inline will be overriten in prod with sha256 hash
-  @script_src "script-src 'self' 'unsafe-eval' 'unsafe-inline' "
+  @script_src "script-src 'self' 'unsafe-eval' "
   @style_src "style-src 'self' "
   @font_src "font-src 'self' "
 
@@ -76,7 +75,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
     script_src =
       if Config.get(:env) == :dev do
-        @script_src
+        [@script_src, "'unsafe-inline' "]
       else
         [
           @script_src,

test/web/plugs/http_security_plug_test.exs

@@ -73,7 +73,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
       [csp] = Conn.get_resp_header(conn, "content-security-policy")
 
       assert csp =~
-               ~r/script-src 'self' 'unsafe-eval' 'unsafe-inline' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
+               ~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
     end
   end