7

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive.

https://w3c.github.io/webappsec-csp/#directive-script-src-elem

This documents the new addition but I am not able to clearly differentiate between the usage, maybe due to hard language.

1 Answer 1

2

Script-src-elem works on script tags:

<script>alert(1)</script>
<script src="/jquery.js">

Script-src-attr works on attributes that contain JavaScript:

<svg onload="alert(1)">

More information can be found in the Intent to Implement and Ship: CSP3: script-src-attr, script-src-elem, style-src-attr, style-src-elem directives

1
  • Will the reports generated by the violation of script-src directive be replaced by script-src-elem then?
    – Nitanshu
    Commented Jun 13, 2019 at 6:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .