csp.yml

---
whitelist: {}
flags:
  script-src-elem:
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
    unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
  script-src-attr:
    unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
    unsafe-inline: true # nocheck: csp-unsafe  Reason: upstream libretranslate/templates/index.html:71 (v1.9.6) calls changeLocale(this) from an inline onchange, so without it the language selector of the interface is dead and every interface load logs a blocked inline event handler