Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Content Security Policy #55

Closed
jmstfv opened this issue Oct 9, 2019 · 3 comments 路 Fixed by #61
Closed

Content Security Policy #55

jmstfv opened this issue Oct 9, 2019 · 3 comments 路 Fixed by #61
Labels
feature question

Comments

@jmstfv
Copy link
Contributor

jmstfv commented Oct 9, 2019

@markets 馃憢

I have enabled a Content Security Policy but that breaks invisible captcha since inlined CSS changes every second. I can make it work by setting style-src to unsafe-inline but that's more of a hack.

Is there a way to insert a nonce to a generated<style> tag?
@markets
Copy link
Owner

markets commented Oct 9, 2019 •
edited

Hi @jmstfv 馃憢 to be honest I didn't tried yet this combination: CSP + invisible_captcha. So not sure what's happening here...

Couple of comments:

@jmstfv
Copy link
Contributor Author

jmstfv commented Oct 9, 2019 •
edited

I see.

One way of doing it would be adding html_options parameter that we could then pass along to the content_tag:

html_options[:nonce] = content_security_policy_nonce if html_options[:nonce] == true

content_tag(:style, media: 'screen', html_options) do

Then users could pass nonce: true attribute, just like here (scroll to the bottom of that section).

<%= invisible_captcha_styles nonce: true %>

Here is the sample code that demonstrates that: slim-template/slim#810 (comment)

Are you open for a PR?

@markets
Copy link
Owner

markets commented Oct 9, 2019 •
edited

Ok @jmstfv PRs for CSP support are welcome!

About the implementation, it's seems fine to me to allow html_options to be passed to the syle TAG, but we should make it work for both options: injectable_styles = true | false.

Maybe we can use the options argument, which is passed along the methods and actually used to allow other custom options:

invisible_captcha/lib/invisible_captcha/view_helpers.rb

Line 25 in 02b9eb9

def build_invisible_captcha(honeypot = nil, scope = nil, options = {})
=>

invisible_captcha/lib/invisible_captcha/view_helpers.rb

Line 48 in 02b9eb9

def visibility_css(css_class, options)

Thanks.

@markets markets added the feature label Oct 9, 2019
@jmstfv jmstfv mentioned this issue Nov 4, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
feature question
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add support for the CSP nonce
2 participants
@markets @jmstfv