Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[4] Feature. Plugin HTTP Header. Make csp_nonce available for JS. #38096

Closed
ReLater opened this issue Jun 19, 2022 · 4 comments
Closed

[4] Feature. Plugin HTTP Header. Make csp_nonce available for JS. #38096

ReLater opened this issue Jun 19, 2022 · 4 comments
Labels
No Code Attached Yet

Comments

@ReLater
Copy link
Contributor

ReLater commented Jun 19, 2022 •
edited

@zero-24

Is your feature request related to a problem? Please describe.

  • A JavaScript adds or changes a <style> block dynamically on any window resize. The <style> gets appended to the <HEAD>.
  • The CSS is blocked by the CSP header if style-src-nonces are activated in HTTP Header plugin.
  • Therefore one have to add the nonce="..." attribute to the <style> by JS.

Describe the solution you'd like

  • At the moment I use an additional custom system plugin that makes the nonce available via JS by:
public function onAfterDispatch()
{
 // csp_nonce parameter set by HTTP Header plugin in `__construct()`.
 Factory::getDocument()->addScriptOptions('csp_nonce', $this->app->get('csp_nonce', ''));
}
  • Then i can get the nonce in JS via:
const nonce = Joomla.getOptions('csp_nonce', '');
let css = document.createElement('style');

if (nonce)
{
 css.setAttribute("nonce", nonce);
}

which works fine for me.

Additional context

  • Is it possible to integrate the addScriptOptions() part in the HTTP Header plugin?

Thank you for your attention!
@ReLater ReLater changed the title Plugin HTTP Header. Make csp_nonce available for JS. [4] Feature. Plugin HTTP Header. Make csp_nonce available for JS. Jun 19, 2022
@zero-24
Copy link
Contributor

zero-24 commented Jun 19, 2022

Hmm I'm not sure whether its a good idea to make the nonce aviable to JS as its the point that the hashes and nonces are generated outside of JS etc.
What about passing the new script via the addscript/addstyle that will generate the hash and nonce?

@ReLater
Copy link
Contributor Author

ReLater commented Jun 19, 2022

I'm not sure whether its a good idea to make the nonce aviable to JS as its the point that the hashes and nonces are generated outside of JS etc.

I don't know. My thought was that the whole source code displays the nonce attributes at several places. So, they could be picked out without any problems by malicious JS, too.

What about passing the new script via the addscript/addstyle that will generate the hash and nonce?

It's a dynamic JS calculation of the height of a container after any window.resize to adapt a scroll target point via CSS. addscript/addstyle are PHP methods. Even if I would find a way to write files dynamically it would mean that I write a file for any guest (different window sizes) and/or I would have to use overheaded AJAX methods.

@zero-24
Copy link
Contributor

zero-24 commented Jun 19, 2022

I don't know. My thought was that the whole source code displays the nonce attributes at several places. So, they could be picked out without any problems by malicious JS, too.

Its even hidden in the source code editor / browser console.

It's a dynamic JS calculation of the height of a container after any window.resize to adapt a scroll target point via CSS. addscript/addstyle are PHP methods. Even if I would find a way to write files dynamically it would mean that I write a file for any guest (different window sizes) and/or I would have to use overheaded AJAX methods.

yes there is also an inline JS/CSS methods that dont require written files.

@ReLater
Copy link
Contributor Author

ReLater commented Jun 19, 2022

yes there is also an inline JS/CSS methods that dont require written files.

Ja, aber auch PHP. Das löst das Problem nicht.

@ReLater ReLater closed this as completed Jun 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
No Code Attached Yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zero-24 @joomla-cms-bot @ReLater