PR for #4061: Excessive CSP error logged for inline scriplet injection

[argothiel]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

As advised in #4061 (comment), here is the Pull Request to resolve the issue:
gorhill/uBlock@master...argothiel:uBlock:csp-inline-precheck

Note that the PR cannot be opened directly due to the repository limitations.

A specific URL where the issue occurs.

https://github.com/uBlockOrigin/uBlock-issues/issues/4061

Steps to Reproduce

1. Go to gorhill/uBlock@master...argothiel:uBlock:csp-inline-precheck
2. Click "Create pull request".

Expected behavior

The pull request for #4061 is opened.

Troubleshooting information

uBlock Origin: 1.72.2
Firefox: 153
filterset (summary):
 network: 215538
 cosmetic: 122908
 scriptlet: 47028
 html: 3778
listset (total-discarded, last-updated):
 added:
  adguard-cookies: 39824-109, 1h.9m
  ublock-cookies-adguard: 5825-80, 1d.4h.18m
  fanboy-cookiemonster: 47361-3966, 4d.7h.43m
  ublock-cookies-easylist: 5825-5825, 1d.4h.21m
  POL-0: 9119-55, 9m
  POL-3: 28313-1, 1h.9m
 default:
  user-filters: 12-0, never
  ublock-filters: 53802-72, 1h.9m Δ
  ublock-badware: 10137-17, 1h.9m Δ
  ublock-privacy: 4106-2, 1h.9m Δ
  ublock-unbreak: 2860-1, 1h.9m Δ
  ublock-quick-fixes: 529-13, 1h.9m Δ
  easylist: 85229-136, 1h.9m Δ
  easyprivacy: 56207-42, 1h.9m Δ
  urlhaus-1: 48080-11, 5h.9m
  plowe-0: 3520-1031, 4d.7h.42m
filterset (user): [array of 12 redacted]
trustedset:
 added: [array of 13 redacted]
switchRuleset:
 removed:
  no-large-media: behind-the-scene false
  no-csp-reports: * true
hostRuleset:
 removed:
  behind-the-scene * * noop
  behind-the-scene * image noop
  behind-the-scene * 3p noop
  behind-the-scene * inline-script noop
  behind-the-scene * 1p-script noop
  behind-the-scene * 3p-script noop
  behind-the-scene * 3p-frame noop
userSettings:
 showIconBadge: false
hiddenSettings: [none]
supportStats:
 allReadyAfter: 371 ms (selfie)
 maxAssetCacheWait: 141 ms
 cacheBackend: indexedDB

[gorhill]

I will decline this PR.

Sorry, I decided to close the project to PRs. There is a real actual fix for this issue, and this PR is not it.

[argothiel]

@gorhill No problem, I just wanted to make sure this wasn't missed as you mentioned that you'd consider fixing it on the uBlock side.

I assume by "real fix" you mean the one in Firefox? I'll take a look at it when I have a moment.

[krystian3w]

Theoretically, in this repo it close PR would also be possible to prevent anyone from creating the security.md file with garbage again:

https://github.com/uBlockOrigin/uBlock-issues/pulls?q=is%3Apr+is%3Aclosed+security