[#28353] - [4.0] Fix notice when script hashes enabled
- Fixed in Code Base
- 3 Apr 2020
- Medium
- Build: 4.0-dev
- # 28353
- Diff
- wilsonge:fix/csp-script-hash
- Pending Hound Hound is busy sniffing around... Details
User tests: Successful: Unsuccessful:
Summary of Changes
Fixes CSP Notice when script hashes enabled. This was caused by #25357 which made the script content an array of scripts which we now need to loop through.
Testing Instructions
Setup CSP Component Configuration as follows:
then navigate to the article list view.
Expected result
No PHP Warning
Actual result
Warning
: hash() expects parameter 2 to be string, array given in
JROOT/plugins/system/httpheaders/httpheaders.php
on line
164
Documentation Changes Required
None
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Front End Plugins |
| Title |
|
||||||
This fixes the notice but functionality is still broken. Hashes don't match because renderer adds line breaks and tabs to inline scripts/styles.
How do I reproduce. As far as I can see at a glance - the inline styles etc are being blocked but I struggling to prove whether the hash's are correct or not?
Enable hashes and add script-src and style-src directives with self value. Inline scripts/styles added with Document API are blocked but they shouldn't be.
Well it is that the API does not longer return the actual style & script information. I think we have two ways around that. One would be that we fix the API correctly returns the script to be added in the end. The other way would be that we add the missing parts our self to the script to get the correct hash within the plugin code.
@SharkyKZ found the reason here: #26505 (comment)
Since #25357 rendered scripts/styles have formatting added to them. But the hash is generated from scripts/styles without formatting. So the hashes don't match scripts/styles that appear on the page.
Assuming SRI works on pages with MIME type other than text/html, this was actually broken since the beginning because we wrap code in CDATA on such pages:
I have tested this item
Tested successfully in a new J4 install at launch site.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28353.
I have tested this item
Tested OK! in J4 launch site.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28353.
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-04-03 16:20:35 |
| Closed_By | ⇒ | wilsonge | |
| Labels |
Added:
?
|
||
This fixes the notice but functionality is still broken. Hashes don't match because renderer adds line breaks and tabs to inline scripts/styles.