The use of 'unsafe-inline' or 'unsafe-eval' or '*' in the
Content-Security-Policy lines of manifest.json files is the equivalent
of 'setenforce 0'.
It's not okay to disable this security measure for code included in the
Cockpit codebase. This security measure prevents XSS, code-injection and
other security attacks.
To bring this closer to home, the following aren't allowed:
* onclick='...' attributes
* <script> ... </script> inline scripts
-> Include a script file rather than inline scripts
* <style> ... </style> inline CSS
-> Include this in your CSS file rather than inline
* style='...' attributes
* eval() or Function()
By default Cockpit will refuse to allow them in loaded pages or
the manifest.json file to bypass this.
I've added some testing so that such code in the Cockpit repository will