No 'unsafe' Content-Security-Policy in Cockpit

[Stef Walter]

The use of 'unsafe-inline' or 'unsafe-eval' or '*' in the
Content-Security-Policy lines of manifest.json files is the equivalent
of 'setenforce 0'.

http://cockpit-project.org/guide/latest/packages.html#package-manifest

It's not okay to disable this security measure for code included in the
Cockpit codebase. This security measure prevents XSS, code-injection and
other security attacks.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

To bring this closer to home, the following aren't allowed:

* onclick='...' attributes
   -> Attach event handlers from javascript instead.

* <script> ... </script> inline scripts
   -> Include a script file rather than inline scripts

* <style> ... </style> inline CSS
   -> Include this in your CSS file rather than inline

* style='...' attributes
   -> Use your CSS file or javascript to set dynamic styles

* eval() or Function()
   -> Never evaluate javascript directly

By default Cockpit will refuse to allow them in loaded pages or
javascript ... and we shouldn't use 'unsafe-inline' or 'unsafe-eval' in
the manifest.json file to bypass this.

I've added some testing so that such code in the Cockpit repository will
be detected.

https://github.com/cockpit-project/cockpit/pull/7391

Happy hacking,

Stef