I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) and began to wonder if any such thing would be important for code that's entirely client-side. I'd apply some basic CSP if I could, mainly the ban on inline code exec, but it looks like that can only be specified in an HTTP header which I don't control in this case (I think -- there's no transfer happening in my game, but github pages hosts the HTML and JS so HTTP is in use and is presumably controlled by github)
This question addresses a similar concern, but is a simpler context since it will be running locally on that OP's machine. My context will be as follows:
- Where is the HTML and JS hosted: my github pages account. It's not actually up there yet, but a different one implemented in Inform 6 and run on a JS Inform interpreter (Quixe) is here and I don't see an obvious CSP in the HTTP headers
- Where do dependencies come from: local JS files, jquery and undum library only
- What operations are involved: clicking generated links within the page, generating/rendering HTML from local JS (no arbitrary text user input), writing to/reading from HTML5 window.localStorage object if available to support game save/load
- Protocol: HTTPS
What security concerns might be relevant to a kinda sorta web app like this? There's no sensitive data involved; I'm mostly concerned with any sort of malicious script injection that might be possible.