Allow setting strict-dynamic on strict-src-elem and set it by default
#41571
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
susnux
requested review from
nickvergessen,
juliushaertl,
a team,
ArtificialOwl,
Fenn-CS and
sorbaugh
and removed request for
a team
…-src-elem` only This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
susnux
force-pushed
the
fix/allow-strict-dynamic-elem
branch
from
b137a35
to
c209295
Compare
We added support for this with NC27 but I do not think we should backport the default change. Opinions? |
juliushaertl
approved these changes
Nov 17, 2023
AndyScherzinger
approved these changes
Nov 17, 2023
… on `script-src-elem` Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
susnux
force-pushed
the
fix/allow-strict-dynamic-elem
branch
from
c209295
to
e231abd
Compare
|
Fixed one test I forgot to update. |
|
Documentation: nextcloud/documentation#11291 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add a function to set 'strict-dynamic' to
script-src-elemonly which allows setting it with less weaken the CSP.This is required for modern JS code that uses
importwhich does not allow to use nonces (there is simply no way to set a nonce on import). Chrome then enforces the nonce rule and fails because there is none.So instead of setting 'strict-dynamic' on every script source we only trust scripts provided with
<script>tags by default and only if they have the nonce set.Checklist