1

Here is an extract from a CSP report

[csp-report] => Array
    (
        [blocked-uri] => chrome-extension
        [column-number] => 27329
        [document-uri] => https://www.mysite.com/mypage/
        [line-number] => 3
        [referrer] => https://www.google.com/
        [source-file] => https://www.mysite.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
        [violated-directive] => font-src
    )

Here is the list of font sources that are legitimate (according to the policy):

'self'
code.ionicframework.com
data:
fonts.googleapis.com
fonts.gstatic.com
http://use.fontawesome.com
https://use.fontawesome.com

I am trying to understand what happened that gave rise to the CSP policy violation. I note, too, that when I visit the page concerned, everything appears normal and no violation of the policy occurs.

So, here is how I interpret the report, but I am not at all sure of my interpretation. So I am asking for help in understanding it.

  1. A visitor is referred to mypage having found it via a Google search.
  2. The visitor performs some manipulation that triggers a call to a function in wp-includes/js/jquery/jquery.js?ver=1.12.4-wp (it is a WordPress site, as you might guess)
  3. That function attempts to load a font from a source that is not allowed as per my policy (I do not display the policy here, for reasons of confidentiality)
  4. The CSP font-src policy blocks the loading of the font and generates the report above (redacted).

Questions:

  1. Is my understanding of the events correct?
  2. Why is the blocked uri called "chrome-extension"? Does this imply that the font source is expected to be local to the server? Or local to the client?
  3. If, for some reason, I wanted to change the policy accept whatever font was attempted to be loaded, how would I do that, given that chrome-extension is not a valid entry to the list of sources?
1
  • I would guess the user has a Chrome extension that uses the jQuery instance available on the page to load a font. The blocked URI could be hidden under "chrome-extension" for security reasons. But who knows.
    – Monsignor
    May 26, 2021 at 13:30

0

You must log in to answer this question.

Browse other questions tagged .