Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HtmlPolicy to forbid inline event handlers #20

Closed
kelunik opened this issue Sep 28, 2020 · 1 comment
Closed

HtmlPolicy to forbid inline event handlers #20

kelunik opened this issue Sep 28, 2020 · 1 comment
Assignees
@casid
Labels
enhancement New feature or request

Comments

@kelunik
Copy link
Collaborator

kelunik commented Sep 28, 2020

Most projects should have a strict content security policy and should be using it without unsafe-inline to be effective, so on* attributes should mostly be forbidden instead of being special treated in gg.jte.html.OwaspHtmlTemplateOutput's writeTagAttributeUserContent.
@casid casid self-assigned this Oct 21, 2020
@casid casid added the enhancement New feature or request label Oct 21, 2020
casid added a commit that referenced this issue Oct 21, 2020
@casid
#20 add policy to forbid inline event handlers
06367d4
@casid
Copy link
Owner

casid commented Oct 21, 2020

@kelunik I've added a policy for this.

Right now it is not part of the default OwaspHtmlPolicy. As we don't know if/how users have set up a strict csp I'd suggest to leave the default as is. Advanced users can then add additional policies to fit their need.

What do you think?

@casid casid closed this as completed Oct 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@casid casid

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@kelunik @casid