OTWO-7715 CSP misconfigured — unsafe-inline, unsafe-eval, overly broa…

[Niharika1117]

…d :https source, missing base-uri and form-action directives

[Copilot]

Pull request overview

This PR tightens the application’s Content Security Policy (CSP) to remove unsafe script allowances and migrate inline scripts to nonce-based execution, while also adding missing CSP hardening directives.

Changes:

• Removes unsafe-inline / unsafe-eval from script-src, adds nonce generation/config, and adds base-uri + form-action directives.
• Updates multiple HAML templates to attach CSP nonces to inline scripts (and converts some :javascript filters to explicit nonce-bearing <script> blocks).
• Replaces setTimeout("...") string-eval patterns with function callbacks in several JS assets and forces Google Maps script loading over HTTPS.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
config/initializers/content_security_policy.rb	Updates CSP directives, script allowlist, and enables nonce-based inline scripts.
app/views/projects/estimated_cost.html.haml	Adds CSP nonce to an inline script block.
app/views/project_widgets/_users_logo_js.html.haml	Replaces :javascript with a nonce-bearing <script> block.
app/views/project_widgets/_project_users_js.html.haml	Emits inline JS via javascript_tag(..., nonce: true) with a heredoc.
app/views/project_widgets/_ohloh_code_header.html.haml	Replaces :javascript with a nonce-bearing <script> block.
app/views/project_widgets/_cocomo_js.html.haml	Replaces :javascript with a nonce-bearing <script> block.
app/views/project_licenses/new.html.haml	Adds nonce: true to a javascript_tag emitted via content_for :javascript.
app/views/oh_admin/license_permissions/new.html.haml	Converts inline JS to a nonce-bearing <script> block.
app/views/layouts/tracking_scripts/_google_analytics.html.haml	Adds CSP nonce to the inline Google Analytics configuration script.
app/views/factoids/index.html.haml	Adds nonce: true to an inline javascript_tag.
app/helpers/map_helper.rb	Forces HTTPS for Google Maps loader and adds nonce to inline initialization JS.
app/assets/javascripts/project.js	Replaces string-based setTimeout with a function callback.
app/assets/javascripts/ohloh_suggests.js	Replaces string-based setTimeout with function callbacks.
app/assets/javascripts/admin.js	Replaces string-based setTimeout with a function callback.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.