-
Notifications
You must be signed in to change notification settings - Fork 148
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Inline event handlers not whitelisted by hashes? #468
Comments
I would suggest that the Chrome-specific console text here is a bit Part of the difficulty here is that as a <script> block, one <script> is Maybe nonces are better for this use case, if we do need it? And I'm not sure we do need it. On the application deployer side, where On Tue, Sep 8, 2015 at 8:54 AM Paweł Krawczyk notifications@github.com
|
|
Thanks, these are very helpful notes. I have already filed a Chrome bug report about this message, but wanted to confirm here what should be the correct browser's policy. As for inline event handlers I do see quite a lot of them, especially if you include a Google AdSense code. While perhaps the correct approach should be to rewrite AdSense code not to use inline handlers, right now it is a real problem if you want to enable CSP on real world websites. |
Do those event handlers have to be inline? Is there a reason the necessary On Tue, Sep 8, 2015 at 11:41 AM Paweł Krawczyk notifications@github.com
|
I'm sure they don't have to but in case of embedding a third party code such as Google AdSense you don't have much influence on how it's written. A workaround I came up with is to load AdSense code in a IFRAME from an URL that has a separate, more liberal CSP. |
As for identifying context for whitelisting inline handlers I think it would be quite easy thing to do. For example for such handler:
This might be whitelisted with the following hash expression:
|
This issue was moved to w3c/webappsec-csp#13 |
you can always add <!DOCUMENT html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="default-src none; script-src 'unsafe-hashes' 'sha256-qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob_Tng='; img-src data:">
</head>
<body>
<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'/>"
onload="alert('Hello, world.');">
<script>alert('Hello, world.');</script>
</body>
</html> |
Reading through section 7.15 of the latest CSP2 editor's draft it seems like you can't whitelist an inline event handler with its SHA256 hash. Is this intended exclusion?
Just to provide a bit of background, the following script will only result in one pop-up, from the whitelisted
alert
in the<script>
tag:The inline handler
alert
will not be shown and Chrome will display the following error message:Which on the other hand suggests that a hash could be used to whitelist it (but this may be just a Chrome catch-all message).
The text was updated successfully, but these errors were encountered: