Make app/index*.html CSP more restrictive

[diracdeltas]

At minimum

• get rid of 'unsafe-inline'

Good to have

• get rid of img-src * (needed for favicons)

[bbondy]

Favicons after downloading via xhr we can base64 and use data urls. I think we should have that anyway for session restore and other props inside the frameProps.

[diracdeltas]

Favicons after downloading via xhr we can base64 and use data urls. I think we should have that anyway for session restore and other props inside the frameProps.

yep, would just have to send the XHR in a child browsing context (webview / iframe / maybe a worker?) so as to avoid connect-src *; c.f. https://www.w3.org/TR/CSP2/#which-policy-applies

[diracdeltas]

Inline scripts are gone. Inline styles are tricky because the webpack style loader that we're using inserts them.

[bbondy]

FYI for preferences I added the same for the webpack included less files and font-awesome.

[diracdeltas]

Closing in favor of #12263