CSP: ui:debug doesn't work with CSP turned on

[martin654]

Describe the bug

ui:debug doesn't work with enabled CSP in Primefaces

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'nonce-YmJlMjkxY2QtODcxMS00NGI4LTkwM2MtMDY1ZmI1NjM1ZTNk'".

Reproducer

1. enable

<context-param>
     <param-name>primefaces.CSP</param-name>
     <param-value>true</param-value>
 </context-param>

2. use ui:debug in page:
   <ui:debug hotkey="x" />

3. press ctrl+shift+x on page in browser

4. see browser console

Reproducer project:
primefaces-test-ui-debug.zip

Expected behavior

debug window is shown

PrimeFaces edition

Elite

PrimeFaces version

13.0.8

Theme

No response

JSF implementation

Mojarra

JSF version

4.0.7

Java version

17

Browser(s)

Chrome

[melloware]

Unfortunately as you know ui:debug is a JSF component NOT a PF component and it uses JS eval. In all of PrimeFaces code we do this...

PrimeFaces.csp.eval(XXX);

Which allows for eval under CSP. Becuase ui:debug is doing a raw eval you will get this CSP violation. Not sure there is anything PF can fix about this...

[melloware]

both Mojarra and MyFaces do this in UIDebug.java...

sb.append("function faceletsDebug(URL) { day = new Date(); id = day.getTime(); eval(\"page\" + id + \" "
                  + "= window.open(URL, '\" + id + \"', 'toolbar=0,scrollbars=1,location=0,statusbar=0,menubar=0,"
                  + "resizable=1,width=800,height=600,left = 240,top = 212');\"); };");

[martin654]

I understand. Thank you for investigating it.

[melloware]

@martin654 i could add a <pe:debug> to PrimeFaces Extensions which will handle the CSP if you are interested we could open a ticket over at PFE?

[melloware]

for now i will close this as this is an issue in both JSF libs.

[martin654]

@martin654 i could add a <pe:debug> to PrimeFaces Extensions which will handle the CSP if you are interested we could open a ticket over at PFE?

Hi, we use ui:debug sometimes in non-prod environment. We can templorarily disable CSP for this. It isn't a must-have feature for us, but thanks for the offer. Thanks