CSP issues in version 0.1.1 #106
Comments
Merged
sorin-davidoi
added a commit
to sorin-davidoi/flathub-website
that referenced
this issue
May 5, 2022
Infer the current rules from https://beta.flathub.org and inscribe them in the policy. From my testing using Laboratory (Content Security Policy / CSP Toolkit) everything seems to work just fine. The only caveat is that one inline script is blocked (`Content Security Policy: The page's settings blocked the loading of a resource at data:text/javascript;base64,IWZ1bmN0aW9u… ("script-src").`). This script is injected by the `next-themes` package, and the only way to make it run is to add `data:` to `script-src`, which is a trade-off that I don't think it's worth it, especially since the theme switching seems to work just fine without this script. Note that in the next version of the package we should be able to add a hash exception for this script: pacocoursey/next-themes#106, which is a much better trade-off. Note that I haven't tested being authenticated and anything payment related, so a few things might be necessary.
sorin-davidoi
added a commit
to sorin-davidoi/flathub-website
that referenced
this issue
May 5, 2022
Infer the current rules from https://beta.flathub.org and inscribe them in the policy. From my testing using Laboratory (Content Security Policy / CSP Toolkit) everything seems to work just fine. The only caveat is that one inline script is blocked (`Content Security Policy: The page's settings blocked the loading of a resource at data:text/javascript;base64,IWZ1bmN0aW9u… ("script-src").`). This script is injected by the `next-themes` package, and the only way to make it run is to add `data:` to `script-src`, which is a trade-off that I don't think it's worth it, especially since the theme switching seems to work just fine without this script. Note that in the next version of the package we should be able to add a hash exception for this script: pacocoursey/next-themes#106, which is a much better trade-off. Note that I haven't tested being authenticated and anything payment related, so a few things might be necessary. The CSP string might not be very readable, but it's easy to test by copy-pasting it into Laboratory (Content Security Policy / CSP Toolkit) and similar tools, so I've left it like that (instead of storing it into an object and stringifying it later).
razzeee
pushed a commit
to flathub-infra/website
that referenced
this issue
May 6, 2022
Infer the current rules from https://beta.flathub.org and inscribe them in the policy. From my testing using Laboratory (Content Security Policy / CSP Toolkit) everything seems to work just fine. The only caveat is that one inline script is blocked (`Content Security Policy: The page's settings blocked the loading of a resource at data:text/javascript;base64,IWZ1bmN0aW9u… ("script-src").`). This script is injected by the `next-themes` package, and the only way to make it run is to add `data:` to `script-src`, which is a trade-off that I don't think it's worth it, especially since the theme switching seems to work just fine without this script. Note that in the next version of the package we should be able to add a hash exception for this script: pacocoursey/next-themes#106, which is a much better trade-off. Note that I haven't tested being authenticated and anything payment related, so a few things might be necessary. The CSP string might not be very readable, but it's easy to test by copy-pasting it into Laboratory (Content Security Policy / CSP Toolkit) and similar tools, so I've left it like that (instead of storing it into an object and stringifying it later).
|
So how do we negate the CSP error in v0.2? |
|
@dan2kx, you could include the hash exception for the inline script in the CSP Option 1 (suggested): |
sorin-davidoi
added a commit
to sorin-davidoi/flathub-website
that referenced
this issue
May 26, 2022
Apply the suggested fix from pacocoursey/next-themes#106 (comment). The only downside is that if the script changes when the dependency is upgraded, the hash would need to be updated accordingly. Closes flathub-infra#298.
razzeee
pushed a commit
to flathub-infra/website
that referenced
this issue
May 26, 2022
Apply the suggested fix from pacocoursey/next-themes#106 (comment). The only downside is that if the script changes when the dependency is upgraded, the hash would need to be updated accordingly. Closes #298.
|
How would I create a new sha256 for the latest version? |
|
I ran the following code in the console of my browser to get the hash value. // Extract the content from the script element output by next-themes and store it in data
const script_content = document.querySelector('#__next > script').innerHTML,
enc = new TextEncoder(),
data = enc.encode(script_content);
// Function to encode the content of an array buffer to BASE64
function _arrayBufferToBase64( buffer ) {
var binary = '';
var bytes = new Uint8Array( buffer );
var len = bytes.byteLength;
for (var i = 0; i < len; i++) {
binary += String.fromCharCode( bytes[ i ] );
}
return window.btoa( binary );
}
// Calculate the cryptographic digest from the content of data, and output it as a Hash value after encoding it with BASE64
crypto.subtle.digest('SHA-256', data).then(function(val){
const digest = ["sha256", _arrayBufferToBase64(val)].join('-');
console.log(`The digest for your script is: ${digest}`);
});Ref. https://www.vector-logic.com/blog/posts/generating-csp-hash-from-browser-console |
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello,
In version
0.1.1there is still a problem with CSPscript-srcdirective because it requiresdata:to work correctly.I see that it's fixed in
0.2.0-beta.0, and the<script>tag now renders inside the<body>element with normal content (not base64 encoded). With this in place, it's possible to add a hash exception to the CSP policy. Are there any plans to release it?The text was updated successfully, but these errors were encountered: