Fix for ignored CSP_NONCE in ContentSecurity Header
#43573
Merged
Commits on Aug 13, 2024
-
fix: Use
CSP_NONCEenv variable in ContentSecurity HeaderWe should use 'cspNonceManager' for requesting the NONCE value, because it is doing the same as before, except that it honors a CPS_NONCE environment variable if available. Signed-off-by: Holger Hees <[email protected]>
-
fix: Make sure CSP nonce is not double base64 encoded
Signed-off-by: Ferdinand Thiessen <[email protected]>
-
test: Adjust tests for CSP nonce
Signed-off-by: Ferdinand Thiessen <[email protected]>
-
feat: Provide CSP nonce as
<meta>elementThis way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen <[email protected]>
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.