[#37859] - [4.1] mod_feed. Inline CSS style not working when using Content-Security-Policy with Nonces
- Closed
- 23 May 2022
- Medium
- Build: 4.1-dev
- # 37859
Steps to reproduce the issue
J!4.1.3. Current Firefox.
At the end of the day it's somehow a security issue because users can't activate security settings without losing functionality here or there.
Related #37799 (Same reason. Inline scripts in Joomla core make usage of CSP with nonces pointless).
Step 1:
- Create a FE module
mod_feed.- Example feed:
https://www.rki.de/SiteGlobals/Functions/RSSFeed/RSSGenerator_nCoV.xml - Set
RTL Feed:Yes. - Position
BannerofCassiopeia.
- Example feed:
- See module in frontend: It's right aligned. OK. (Image 1).
Step 2:
- In plugin
System - HTTP Headers- Activate
Content-Security-Policy (CSP). - Don't activate any switch.
- Add Policy Directive:
style-src: 'self' 'unsafe-inline' - Activate plugin
- Activate
- See module in frontend: It's right aligned. OK. (Image 1).
Step 3:
- In plugin
System - HTTP Headers- Activate
Nonce - Change Policy Directive:
{nonce} 'self' 'unsafe-inline'
- Activate
- See module in frontend: It's left aligned. NOT OK. (Image 2).
Reason:
- Inline style https://github.com/joomla/joomla-cms/blob/4.1.3/modules/mod_feed/tmpl/default.php#L69
direction: rtlignored.
Image 1
Image 2
Additional comments
Inline scripts and styles shouldn't be used in Joomla core.
joomla-cms-bot
- | Labels |
Added:
No Code Attached Yet
|
||
A B\C solution can be something like this: https://github.com/ReLater/joomla-cms/pull/1/files
Other solution could be to add new helper classes to core CSS files like direction-rtl and direction-ltr, but not B\C if people use other templates.
A B\C solution can be something like this: https://github.com/ReLater/joomla-cms/pull/1/files
changed https://github.com/ReLater/joomla-cms/pull/1/files accordingly and got right aligned in frontend:
<div class="text-right feed modFeedDir-169"> <h2 class=" redirect-ltr">
richard67
- | Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-05-23 20:41:40 |
| Closed_By | ⇒ | richard67 |
@ReLater
Confirmed. Thank you for your instructions/explanations.
unsafe-inline'" is ignored inside script-src or style-srcContent Security Policy: The site's settings have blocked loading of a resource on inline ("style-src").This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/37859.