Merge pull request #87 from blockchain/unsafe-inline-css

refactor(CSP): unsafe-inline CSS

Author: abhisharma2

app/index.jade

@@ -181,7 +181,6 @@ head
     }
 
 body(ng-controller="AppCtrl", ui-view="body")
-  noscript(style="display:flex; display: -webkit-flex;  -webkit-flex-direction: column; flex-direction: column; -webkit-justify-content: center; justify-content: center; -webkit-align-items: center; align-items:center; height: 100%; width: 100%;")
-      img(src="/img/logo-bw.png" style="margin-bottom: 3em;")
-      h3(style="").
-        Please enable JavaScript to use the Blockchain Wallet
+  noscript
+    img(src="/img/logo-bw.png")
+    h3 Please enable JavaScript to use the Blockchain Wallet

assets/css/blockchain.css.scss

@@ -121,3 +121,20 @@ html,body {
   }
 }
 .z-10 { z-index: 10; }
+
+noscript {
+  display:flex;
+  display: -webkit-flex;
+  -webkit-flex-direction: column;
+  flex-direction: column;
+  -webkit-justify-content: center;
+  justify-content: center;
+  -webkit-align-items: center;
+  align-items:center;
+  height: 100%;
+  width: 100%;
+
+  img {
+    margin-bottom: 3em;
+  }
+}

server.coffee

@@ -29,7 +29,11 @@ dist = process.env.DIST? && parseInt(process.env.DIST)
 app.configure ->
   app.use (req, res, next) ->
     if req.url == "/"
-      res.setHeader "content-security-policy", "img-src 'self' data:; style-src 'self'; frame-src 'self' https://*.youtube.com; script-src 'self' 'sha256-mBeSvdVuQxRa2pGoL8lzKX14b2vKgssqQoW36iRlU9g='; connect-src 'self' *.blockchain.info *.blockchain.com wss://*.blockchain.info https://blockchain.info https://api.sharedcoin.com; object-src 'none'; media-src 'self' data: mediastream: blob:; font-src 'self'"
+      # Inline style hashes, in case we want to remove unsafe-inline:
+      # 'sha256-vv5i1tRAGZ/gOQeRpI3CEWtvnCpu5FCixlD2ZPu7h84=' : angular-charts 
+      # 'sha256-47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU=' : angular-charts
+      # lots... : jQuery
+      res.setHeader "content-security-policy", "img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self' https://*.youtube.com; script-src 'self' 'sha256-mBeSvdVuQxRa2pGoL8lzKX14b2vKgssqQoW36iRlU9g='; connect-src 'self' *.blockchain.info *.blockchain.com wss://*.blockchain.info https://blockchain.info https://api.sharedcoin.com; object-src 'none'; media-src 'self' data: mediastream: blob:; font-src 'self'"
       res.setHeader "X-Frame-Options", "SAMEORIGIN"
     if req.url.indexOf("beta_key")
       # Don't cache these