Avoid use of deprecated window.Controllers for UA detection

[Kolano]

Kibana version:
7.0.0

Elasticsearch version:
7.0.0

Server OS version:
Ubuntu 18.10

Browser version:
Firefox 66.0.2 (64-bit)

Browser OS version:
Windows 10

Original install method (e.g. download page, yum, from source, etc.):
apt-get

Describe the bug:
A few deprecated code / security warnings output with every page load (though it seems at least one is expected)...

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
^ A single error about an inline script not firing due to content security policy is expected!

window.controllers/Controllers is deprecated. Do not use it for UA detection.

Steps to reproduce:

1. Load almost any Kibana page

Expected behavior:
Pages to load without outputting warnings / security errors

Errors in browser console (if relevant):
Indicated above

[elasticmachine]

Pinging @elastic/kibana-security

[legrego]

@Kolano thanks for the report.

In order to support Safari, we are required to use worker-src instead of frame-src (See PR review here where we discuss this). If you do not need to support Safari, then you are free to configure your own CSP rules via csp.rules configuration option in your kibana.yml.

I am going to rename this issue to focus on the window.Controllers warning, since CSP is functioning as designed.

[elasticmachine]

Pinging @elastic/kibana-platform