As of today, Tuleap sets a Content Security Policy [0] that has a very limited usefulness because it is very lax and in "allow all" mode by default. The CSP is an additional layer that could allow us to detect and mitigate XSS and other data injection/theft attacks.
The plan is as follows:
1. Move the current policy to a deny all mode by default but keeping it lax as it is today
2. Set a proper and strict policy but in a report only mode
3. Move this policy out of the report only mode
The steps 2 and 3 are likely to be quite challenging due to some of the elements Tuleap is using (e.g. CKEditor4) or even its own code. It's also likely that to properly apply those changes it's going to require some large refactoring in the way the HTTP requests are handled.
[0]
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP