test report failed with error message ”because the document's frame is sandboxed and the 'allow-scri...

最新推荐文章于 2024-11-17 11:46:23 发布

转载最新推荐文章于 2024-11-17 11:46:23 发布 · 848 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/SusieHu/p/6069516.html

文章标签：

#运维 #javascript #ViewUI

本文介绍如何通过运行Groovy脚本来设置Jenkins的Content-Security-Policy（CSP），以减少跨站脚本（XSS）攻击的风险。具体步骤包括在Jenkins服务器上运行特定的Groovy脚本，设置HTTP响应头来声明允许加载的动态资源。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

The new Content-Security-Policy HTTP response header helps you reduce XSS risks on modern browsers by declaring what dynamic resources are allowed to load via a HTTP Header.

Can setting Jenkins Content Security Policy by Run the Groovy script at at http://jenkinsServer:8080/script( can open the script on manage page).　　

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP","sandbox allow-scripts; default-src 'none';script-src 'unsafe-inline' http://code.jquery.com/jquery-2.1.0.min.js; img-src dohko.hpeswlab.net 'self' data: ; style-src 'unsafe-inline' 'self';");

For more information about CSP, Please refer to https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy & https://content-security-policy.com/ .

转载于:https://www.cnblogs.com/SusieHu/p/6069516.html