Allow setting strict-dynamic on strict-src-elem and set it by default
#41571
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
susnux
requested review from
a team,
ArtificialOwl,
juliusknorr,
nfebe,
nickvergessen and
sorbaugh
and removed request for
a team
…-src-elem` only This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <[email protected]>
susnux
force-pushed
the
fix/allow-strict-dynamic-elem
branch
from
b137a35 to
c209295
Compare
Contributor
Author
We added support for this with NC27 but I do not think we should backport the default change. Opinions? |
juliusknorr
approved these changes
Nov 17, 2023
AndyScherzinger
approved these changes
Nov 17, 2023
… on `script-src-elem` Signed-off-by: Ferdinand Thiessen <[email protected]>
susnux
force-pushed
the
fix/allow-strict-dynamic-elem
branch
from
c209295 to
e231abd
Compare
Contributor
Author
|
Fixed one test I forgot to update. |
Contributor
Author
|
Documentation: nextcloud/documentation#11291 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add a function to set 'strict-dynamic' to
script-src-elemonly which allows setting it with less weaken the CSP.This is required for modern JS code that uses
importwhich does not allow to use nonces (there is simply no way to set a nonce on import). Chrome then enforces the nonce rule and fails because there is none.So instead of setting 'strict-dynamic' on every script source we only trust scripts provided with
<script>tags by default and only if they have the nonce set.Checklist