21

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-src due to a third-party component. (Both connect-src and img-src are otherwise restricted to self and some hard-coded URLs.)

So, my question is: Is allowing blob: a general security risk in the sense that an attacker can in an injected script wrap any URL with blob and thus connect to any arbitrary resource?

1
  • 1
    Are you sure what this 3rd party component puts in that Blob? blob: could be an attack vector if attacker manage to create a Blob of their attack script. Difference with data: or http: is that this Blob must be created on the same origin than your website, which narrows the ways of building it (you cannot load a Blob from another origin using blob:)
    – Xenos
    Commented Jul 25, 2018 at 7:43

1 Answer 1

6

A blob represents file-like data in client's memory (it may also be backed up by a temporary file). That data can be loaded or saved using JavaScript commands, including loaded/saved to a local file for persistence.

The URL is used for security reasons. That is, if the JavaScript trying to load or save a blob comes from 3rd-party.example.com, then you can block that URL (as you've noticed) to prevent that script from accessing the file system.

If you trust the source of the JavaScript attempting to access blobs (a.k.a. local files), then authorizing them is safe. Of course, you should specifically add those third party domains to your policy:

Content-Security-Policy: connect-src 'self' '3rd-party.example.com', ...

The load & save features won't create an HTTP connection since it just load from & save to local files. This is just how the security is implemented in a browser.

4
  • 3
    I think if you want to add a blob, even from the same origin you have to use the keyword blob: to allow it. It's the protocol that matters here, not the website.
    – El Mac
    Commented May 13, 2022 at 14:12
  • My example shows that you need to include the other URL(s) if you want that JS to work as expected. The blob would also be necessary, indeed. Commented May 13, 2022 at 14:52
  • 1
    According to the spec (developer.mozilla.org/en-US/docs/Web/HTTP/Headers/…) the connect-src should never be used for blob: URLs but I guess the issue you're seeing is bug bugs.chromium.org/p/chromium/issues/detail?id=1264540 – I think adding blob: to connect-src should be safe because browser should never actually try to use it if spec is followed. Commented Nov 2, 2022 at 13:13
  • "A blob represents data on the client's file system." - I don't think that's accurate, it does not allow specifying arbitrary paths like the file: scheme. Rather, a blob represents some file object in memory on the client system (possibly backed by a tmp file).
    – Bergi
    Commented Sep 11, 2023 at 10:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .