dsa-webworker can't load scripts if CSP uses nonce

[fancycode]

I'm running ojsxc 3.1.1 on Nextcloud 11.0.3 which uses a CSP with a random nonce for loading scripts:

content-security-policy:default-src 'none';script-src 'nonce-T3JrazRtVzhXbzI5djU1Q01uQXR5ZFhFVXFPRlFuNTNUSHBTdk9TaVIyUT06WGRRVTF3cUtITW4vemU0aGZTUkF2NFdpTzlyd0N6d0VIeXRxaTdickl4RT0=' 'unsafe-eval';style-src 'self' 'unsafe-inline' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self' wss://10.1.7.145 my-domain ;media-src 'self' blob:;frame-src 'self';child-src 'self'

This causes a problem for the dsa-webworker.js which tries to load external scripts but omits the nonce when doing so:

Refused to load the script 'https://10.1.7.145/apps/ojsxc/js/jsxc/lib/otr/vendor/salsa20.js' because it violates the following Content Security Policy directive: "script-src 'nonce-T3JrazRtVzhXbzI5djU1Q01uQXR5ZFhFVXFPRlFuNTNUSHBTdk9TaVIyUT06WGRRVTF3cUtITW4vemU0aGZTUkF2NFdpTzlyd0N6d0VIeXRxaTdickl4RT0=' 'unsafe-eval'".
dsa-webworker.js:36 Uncaught DOMException: Failed to execute 'importScripts' on 'WorkerGlobalScope': The script at 'https://10.1.7.145/apps/ojsxc/js/jsxc/lib/otr/vendor/salsa20.js' failed to load.
    at onmessage (https://10.1.7.145/apps/ojsxc/js/jsxc/lib/otr/lib/dsa-webworker.js:36:19)

[sualko]

In which app does this happens? Do you use any pipe/combine/minify mechanism? Can you post the complete HTTP header?

[sualko]

@theCalcaholic can you post the complete header of the html file on which the error occurs?

[theCalcaholic]

I don't have that error anymore, sorry. It was fixed for me in an update to the jsxc, iirc.

[sualko]

@theCalcaholic thanks for reporting.

[Frakir85]

hi. Have same trouble with Nextcloud 12.0.3
dsa-webworker.js:36 Refused to load the script 'https://cloud.ipcd.ru/apps/ojsxc/js/jsxc/lib/otr/vendor/salsa20.js' because it violates the following Content Security Policy directive: "script-src 'nonce-eHhNT3F2bXFVNXZYNC9oRHYwWGtHcXhMbXRqbDZJSjVTSzJwWDF6Q08wZz06a1VRNXhZSEhGYXlaMFo5MTB5ZWlTZGtNLzRHM3VzY2dJb2JzQnhXa0Nqbz0=' 'unsafe-eval'".
onmessage @ dsa-webworker.js:36

Uncaught DOMException: Failed to execute 'importScripts' on 'WorkerGlobalScope': The script at 'https://cloud.ipcd.ru/apps/ojsxc/js/jsxc/lib/otr/vendor/salsa20.js' failed to load.
at onmessage (http://cloud.ipc.lc/apps/ojsxc/js/jsxc/lib/otr/lib/dsa-webworker.js:36:19)
onmessage @ dsa-webworker.js:36
cloud.ipcd.ru-1508796130690.log

[sualko]

This is a known bug and I already opened an issue nextcloud/server#5936. For me it looks like there is no nice fix for this, so we probably have to concatenate the web worker. Btw. pull requests are always welcome.

[Frakir85]

thx. very helpful. Now as I see everything works as it should. 2017-11-03 11:24 GMT+03:00 okamzol <notifications@github.com>:

…

Hi, have had the same problem and found a working solution. I played a bit with policy rules in app.php and ended up with adding my domain as additional rule for addAllowedScriptDomain. After line 27 add: $policy->addAllowedScriptDomain('https://my.domain.tld'); Tested and works with Chrome Version 61.0.3163.100 — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#521 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AfguFVDCoc5BZi8xHmt0olyMm9c4HVLJks5sys2vgaJpZM4NQo7d> .

[sualko]

I played a bit with policy rules in app.php and ended up with adding my domain as additional rule for addAllowedScriptDomain.

Sadly this doesn't work, because Nextcloud replaces the script-src with a nonce 😢

[sualko]

Hope this fix works for you guys.