Support Content-Security-Policy

The policy alteration should consider the fallback directive (default-src), and overriding directive (script-src-elem).

A publicly available helper function is proposed in #3099423: Helper for altering directives with fallback, but for now can also be copied as a private method on the event subscriber

  public function onCspPolicyAlter(PolicyAlterEvent $alterEvent) {
    $policy = $alterEvent->getPolicy();
    self::fallbackAwareAppendIfEnabled($policy, 'script-src', [Csp::POLICY_UNSAFE_INLINE]);
    self::fallbackAwareAppendIfEnabled($policy, 'script-src-elem', [Csp::POLICY_UNSAFE_INLINE]);
  }

  private static function fallbackAwareAppendIfEnabled(Csp $policy, $directive, $value) {
    if ($policy->hasDirective($directive)) {
      $policy->appendDirective($directive, $value);
      return;
    }

    // Duplicate the closest fallback directive with a value.
    foreach (Csp::getDirectiveFallbackList($directive) as $fallback) {
      if ($policy->hasDirective($fallback)) {
        $policy->setDirective($directive, $policy->getDirective($fallback));
        $policy->appendDirective($directive, $value);
        return;
      }
    }
  }

Wouldn't it be better to avoid unsafe-inline completely by using JSON like it is used for the drupal-settings-json in core ( https://www.drupal.org/node/2513818 ) or by using data attributes in tags?

@sleitner avoiding inline code is preferred, but passing data through drupalSettings is probably a major-version worthy refactor.

e.g. I wrote the Googalytics module as a replacement for the legacy Google Analytics module to be compatible with CSP (among other features). Sites with a basic implementation can just swap modules and match configuration, but any custom implementation will likely need to be rebuilt to be compatible with the different API.

This patch makes the module work in it's current state, and an updated version of the module can remove or update the CSP directive changes as needed.

I can't commit to a timeline ATM, but I'm up to lead or support a refactor of the module similar to Googalytics' API, if the module maintainer(s) are open to it.

I added script-src-elem again.