Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Content Security Police compatibility broken

See original GitHub issue

Are you requesting a feature, reporting a bug or ask a question?

The newest release 1.0.2 broke the compatibility with Content Security Police (CSP) which forbids the use of inline Javascript and the use of “eval()” function.

What is the current behavior?

Browser refuses to execute Javascript. Survey is not showing up at all. unbenannt

What is the expected behavior?

Everything works as it was with 1.0.1.

How would you reproduce the current behavior (if this is a bug)?

Inject a CSP for testing purpose. Add to HTML Head: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self';">

Provide the test code and the tested page URL (if applicable)

Tested page URL: Press F12 to open your javascript console! SurveyJS 1.0.2 (broken): https://iq4s-2.hci.uni-hannover.de/tmp/index.php?id=4ff93b77 SurveyJS 1.0.1 (working): https://iq4s-2.hci.uni-hannover.de/master/index.php?id=4ff93b77

Test code not needed.

Specify your

browser: Google Chrome
browser version: 63
surveyjs platform (angular or react or jquery or knockout or vue): jquery
surveyjs version: 1.0.2

Issue Analytics

State:
Created 6 years ago
Reactions:2
Comments:21 (13 by maintainers)

Top GitHub Comments

2reactions

tsv2013commented, Aug 25, 2021

@gawielgo survey-angular is a wrapper over the survey-knockout package. We have a native angular implementation out of the box in our plans, but not exactly right now

1reaction

tsv2013commented, Dec 2, 2021

Our roadmap for the nearest future was announced by @andrewtelnov here - https://github.com/surveyjs/survey-library/issues/2756#issuecomment-967461460

After SurveyJS Creator V2 we plan to start work on native Angular implementation (latest Angular). Unfortunately we can’t promise you the exact timeframe.

Top Results From Across the Web

Incorrect Content Security Policy Vulnerability

The Content Security Policy (CSP) feature allows web developers to define a fine-grained set of policies concerning the capability of several components of ......

The negative impact of incorrect CSP implementations - Invicti

This post examines incorrect CSP implementations on the New Yorker and Blogger and points out common issues in CSP implementations.

Content Security Policy - OWASP Cheat Sheet Series

Sometimes you cannot use the Content-Security-Policy header if you are, e.g., Deploying your HTML files in a CDN where the headers are out...

Content-Security-Policy Compatibility - Jenkins

Referencing a file to load JavaScript from is fine, but inline block contents are not. All <script> tags without src are a problem....

"content security policy" | Can I use... Support tables ... - CanIUse

5 Chrome 39 and Opera 26 are missing the child-src, base-uri, and form-action directives. 6 Edge has broken nonce support as it ignores...