Jenkins 2.539+ allows setting up Content Security Policy for the regular UI, not just user content as before:

https://www.jenkins.io/doc/book/security/csp/

The plugin currently has inline script blocks and inline event handlers which break with CSP enforced. There may be other problems, but these are the ones I was able to easily find statically. The plugin should be tested on Jenkins 2.539+ with CSP enforced, e.g., mvn -Djenkins.version=2.539 hpi:run or similar.

Inline Script Blocks:

• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L56
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L65
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/report/ReportAction/index.jelly#L209

Inline Event Handlers:

• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L201
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L209
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L264
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L279
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L293
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanBuildStep/config.jelly#L307
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L225
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L234
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L240
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L243
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L272
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L283
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L295
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/WASScanNotifier/config.jelly#L307
• https://github.com/jenkinsci/qualys-was-plugin/blob/8d35e55096f29e9b6b1ada533e5cfe985c9f1783/src/main/resources/com/qualys/plugins/wasPlugin/report/ReportAction/index.jelly#L95

Developer docs:

https://www.jenkins.io/doc/developer/security/csp/#development-guidelines