Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Inject script to pass CSP security header

See original GitHub issue

Currently, when using this package and having a restrictive CSP header (including a hash), you get the following error:

Refused to execute inline script because it violates the following Content Security Policy directive:
"script-src 'self' 'sha256-8vI1As+YvGPUUpPp6RL6G2wI9FGjUN3x9MU3jdupP4s='". Either the 'unsafe-inline' keyword,
a hash ('sha256-ZxiMCbcVxDCutNT7QrHdr+d0Z99vF3DED6pLitElTag='), or a nonce ('nonce-...')
is required to enable inline execution.

As the error says, including a nonce in the script header here would fix the error most likely. An optional parameter passed down from the ThemeProvider.

Issue Analytics

State:
Created 2 years ago
Comments:6

Top GitHub Comments

1reaction

brokul-devcommented, May 2, 2022

Related to: https://github.com/pacocoursey/next-themes/issues/106 You can’t add hash exception for base64 encoded script (current approach). You could add data: to script-src directive for now.

0reactions

shivamjjhacommented, May 3, 2022

Thanks @brokul-dev. Following worked for me: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.youtube.com *.twitter.com data:;

Top Results From Across the Web

CSP: script-src - HTTP - MDN Web Docs - Mozilla

The HTTP Content-Security-Policy (CSP) script-src directive specifies valid sources for JavaScript. This includes not only URLs loaded directly ...

Content Security Policy (CSP) Bypass - HackTricks

script -src: This directive specifies allowed sources for JavaScript. This includes not only URLs loaded directly into elements, but also things like inline ......

Content-Security-Policy (CSP) Bypass Techniques - Medium

It is possible to bypass this CSP policy by calling callback functions and vulnerable class.

How to Set Up a Content Security Policy (CSP) in 3 Steps

A content security policy will prevent most script-injection attacks ... Allows you to add header for the Content Security Policy (CSP).

CSP Allow Inline Scripts - Content Security Policy

Create a CSP Policy that allows execution of inline scripts. ... single use string value that you add to your Content-Security-Policy header, like...