1

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the violation of the CSP directive when trying to access a resource blob:myURL/my-id.

There is an example that showcase good practice and bad practices in the following page: https://csplite.com/csp105/; but this is valid for object-src. What about script-scr?

2
  • By allowing blob: you bypass your own security measure. Why would you do that?
    – Sergej
    Commented Sep 7, 2023 at 6:15
  • @Sergej With blob I access objects in the browser memory. Is it wrong to think that I am allowing the app to access binary data from my trusted domains? Commented Sep 8, 2023 at 7:11

1 Answer 1

0

Allowing the "blob:" directive to the script-src is definitely unsafe. See https://www.w3.org/TR/CSP2/#source-list-guid-matching, Section 4.2.2.1

As defined above, special URL schemes that refer to specific pieces of unique content, such as "data:", "blob:" and "filesystem:" are excluded from matching a policy of * and must be explicitly listed. Policy authors should note that the content of such URLs is often derived from a response body or execution in a Document context, which may be unsafe. Especially for the default-src and script-src directives, policy authors should be aware that allowing "data:" URLs is equivalent to unsafe-inline and allowing "blob:" or "filesystem:" URLs is equivalent to unsafe-eval.

It basically allows you to inject a cross site scripting attack by injecting a script in an Url:

/app?name=<script src="blob:https://bad-guy.example.com/bad-stuff.js"></script>

3
  • Welcome to the community. Can you elaborate more how you came to this conclusion, because in my opinion it sounds like you are extrapolating a lot of things here... Commented Jan 29 at 15:27
  • No I don't. The World Wide Web Consortium (W3C) clearly says that allowing a blob URL in the CSP Header is unsecure. This clearly answers the question. Can you explain in more detail what you don't understand?
    – Jonathan
    Commented Jan 29 at 17:00
  • Where is that stated exactly? Commented Jan 31 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .