TYPO3 Core

(posted by @Peter Schuler at https://typo3.slack.com/archives/C0K5MU94J/p1605704844039500)

I dug a bit: to enable the plugin in Safari for my testcase object-src 'self'; is necessary, to drop console warnings additionally style-src 'unsafe-inline' thus resulting in:

<IfModule mod_headers.c>
  Header set Content-Security-Policy "default-src 'self'; style-src 'unsafe-inline'; script-src 'none'; object-src 'self';" 
</IfModule>

Which is of course a lot unsafer as it only establishes the CSP for JavaScript and a little bit for CSS, but as the aim is XSS and core probably doesn’t have any embed/object stuff this might be considered (by someone with more experience than me).
Thus for the time being perhaps a browser condition might be helpful:

<IfModule mod_headers.c>
  # global rule
  Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" 
  # override for Safari PDF viewer case
  Header set Content-Security-Policy "default-src 'self'; style-src 'unsafe-inline'; script-src 'none'; object-src 'self';" "expr=%{HTTP_USER_AGENT} =~ m#AppleWebKit(.*)Version(.*)Safari(.*)#" 
</IfModule>

(The user agent detection at the back is necessary as “AppleWebKit” and “Safari” are also part of Chromes user string).
This is as far as my knowledge might help.

Worked on an alternative here:

<IfModule mod_headers.c>
    # matching requested *.pdf files only (strict rules block Safari showing PDF documents)
    <FilesMatch "\.pdf$">
        Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;" 
    </FilesMatch>
    # matching anything else, using negative lookbehind pattern
    <FilesMatch "(?<!\.pdf)$">
        Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" 
    </FilesMatch>
</IfModule>

@Alex can you please verify whether the references patch at review.typo3.org solves the problem you described? Thanks in advance for your feedback!

@Oliver: I have no idea how to work with review.typo3.org. Nevertheless I tested both configurations and both are working:

<IfModule mod_headers.c>
  # global rule
  Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" 
  # override for Safari PDF viewer case
  Header set Content-Security-Policy "default-src 'self'; style-src 'unsafe-inline'; script-src 'none'; object-src 'self';" "expr=%{HTTP_USER_AGENT} =~ m#AppleWebKit(.*)Version(.*)Safari(.*)#" 
</IfModule>

<IfModule mod_headers.c>
    # matching requested *.pdf files only (strict rules block Safari showing PDF documents)
    <FilesMatch "\.pdf$">
        Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;" 
    </FilesMatch>
    # matching anything else, using negative lookbehind pattern
    <FilesMatch "(?<!\.pdf)$">
        Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';" 
    </FilesMatch>
</IfModule>

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67087

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67088