8

For some reason, Google couldn't give me the answer easily...

I was reading a Google publication on the insecurity of currently deployed Content Security Policies (CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy) To understand fully, I want to be absolutely clear of all the terminology so whilst this may sound like a simple question, the answer will help with my learning of mitigating against XSS vulnerabilities.

Improve this question
1

2 Answers 2

Reset to default
13

Basically anything that runs without the need to include a separate file.

<script>
document.write('Hi, I am inline');

function myFunction() {
    console.log('So am I')
}
</script>

The reason the paper mentions this is that this piece of code cannot be validated as 'secure', without running it (or perform code analysis). When you only allow scripts by includes (<script src="myscripts.js"></script>) the browser can decide if it wants to load the script based on the response and CSP headers. Same is true for CSS files. This is an effort to prevent malicious code execution.

Improve this answer
5

An inline script is a script that is not loaded from an external file, but embedded inside HTML.

For example, these are inline scripts:

<script>alert(1);</script>

<img src=x onerror=alert(1)>

These however are not inline scripts, they are external scripts:

<script src="http://example.com/script.js"></script>

<script src="/script.js"></script>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .