[#29602] - [4.0] Issue warnings when unsafe-inline or unsafe-eval are used in auto mode
- Fixed in Code Base
- 16 Jun 2020
- Medium
- Build: 4.0-dev
- # 29602
- Diff
- zero-24:unsafe_warning
- Pending Hound Hound is busy sniffing around... Details
User tests: Successful: Unsuccessful:
Summary of Changes
Issue warnings when unsafe-inline or unsafe-eval are used in auto mode
Testing Instructions
- apply this patch
- switch com_csp in detect mode
- visit the frontend with eval and or inline css usage
- publish the collected reports about unsafe-inine / unsafe-eval
- switch com_csp to auto mode
Expected result
You get a warning as this bypasses the CSP
Actual result
You get no info about that bypass.
Documentation Changes Required
Yes.
https://help.joomla.org/proxy?keyref=Help40:Components_CSP_Reports_Options && https://help.joomla.org/proxy?keyref=J4.x:Http_Header_Management
Acknowledgements
Warnings / Message text based on https://csp-evaluator.withgoogle.com/
'unsafe-inline' allows the execution of unsafe in-page scripts and event handlers.
'unsafe-eval' allows the execution of code injected into DOM APIs such as eval().
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_csp Language & Strings |
| Labels |
Added:
?
?
?
|
||
Ah I see I get the message also in the reverse order, when I publish the reports and then change the mode. I get them with mode change then. Makes sense to me and I think it is right.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
Done.
I have tested this item
I changed the image in Help4.x:Components CSP Reports Options, also appearing in J4.x:Http Header Management, for one showing the message and a list of reports.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
| Labels |
Added:
?
|
||
| Status | Ready to Commit | ⇒ | Pending |
Back to pending.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
| Labels |
Removed:
?
|
||
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
One more test needed.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/29602.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-06-16 20:25:40 |
| Closed_By | ⇒ | wilsonge | |
| Labels |
Added:
?
|
||
Thanks!
@zero-24 Is it correct that I first have to change the mode from "Detect" to "Automatic" before publishing the reports? When still in detect mode I don't get the new warnings. If this is correct, then your PR works as intended.