0

The following CSP directive violation is reported:

[csp-report]
    (
        [document-uri] => https://mysite.com/my-page/
        [referrer] => https://www.google.com/
        [violated-directive] => img-src
        [effective-directive] => img-src
        [original-policy] => img-src 'self' https://various.uris <but NOT https://www.tailwindapp.com>
        [disposition] => enforce
        [blocked-uri] => https://www.tailwindapp.com/app/extensions/Tailwind_swoosh.png
        [line-number] => 4
        [column-number] => 31488
        [source-file] => https://mysite.com/wp-includes/js/jquery/jquery.js
        [status-code] => 0
        [script-sample] => 
    )

If I understand correctly, this means that a visitor to my-page was referred from Google search and in the course of viewing that page the file https://www.tailwindapp.com/app/extensions/Tailwind_swoosh.png was blocked. But I cannot understand how there was any attempt to display that file. It is certainly not directly referenced anywhere in my-page. The script https://mysite.com/wp-includes/js/jquery/jquery.js is not corrupted and makes no reference to that file. Nor does it appear in any other file or database for my site.

So, how can I figure out why there was any attempt to display that file in the first place?

3

There's a clue in the blocked URL:

https://www.tailwindapp.com/app/extensions/Tailwind_swoosh.png

The image reference was most likely added to the page locally by a browser extension. Probably this one: https://chrome.google.com/webstore/detail/tailwind-publisher/gkbhgdhhefdphpikedbinecandoigdel - from its description, "Schedule any image on the web by clicking the "Schedule" button when hovering over it." sounds like something likely to inject images (and other things) into arbitrary web pages.

Of course there won't always be this sort of clue, but browser extensions are often responsible for mysterious unexpected requests like this. Troy Hunt writes about the problem here. Client-side malware is another possibility.

2
  • There are a "few" more examples at github.com/nico3333fr/CSP-useful/blob/master/report-uri/…. I think that it is caused by a browser extension which the user has installed. – Daniel Ruf Jan 24 at 13:18
  • I guess there is no simple way to distinguish between requests originating in one's one site and requests originating in a visitor's browser or from fourth parties used by legitimate third parties referenced by your site. Or is there...? My concern is that the vast majority of visitors are likely to think that the problem is on my site, not in their own browsers. – Amblymoron Jan 25 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.