Skip to main content
69 votes
Accepted

Can I trust public code versioning platforms when building a social platform?

Unfortunately, you are the ones responsible of seeing if your threat model is justified or not. Therefore, we cannot simply give a definite "yes" whether we see using the platform as a security threat ...
Simon's user avatar
  • 3,202
56 votes

Is including the data scheme in your Content Security Policy safe?

The note on whitelisting the data protocol which is referenced says data: Allows data: URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use ...
zemnmez's user avatar
  • 681
27 votes
Accepted

Why is CSP needed to protect against img-src leak?

Just to be clear about how the attack works: A site allows you to enter text that is later displayed somewhere. It does not properly filter out HTML. Mallory enters <img src='https://some-evil-...
Anders's user avatar
  • 65.6k
23 votes

Can I trust public code versioning platforms when building a social platform?

@Simon has already provided a fantastic answer, but I'd like to add in response to this point: there is no possible real warranty that staff from Gitlab cannot investigate the source and find ...
Adam Barnes's user avatar
15 votes

CSP allowing all Google domains?

As an addition - not only is it not supported, you wouldn't want it even if it was supported. Because https://www.google.* would then match not only https://www.google.co.uk but also https://www....
Matija Nalis's user avatar
  • 2,305
13 votes

What is an inline script?

Basically anything that runs without the need to include a separate file. <script> document.write('Hi, I am inline'); function myFunction() { console.log('So am I') } </script> The ...
Yorick de Wid's user avatar
12 votes

Why is CSP needed to protect against img-src leak?

If a user presses "View Source" and sends data manually, that's their choice, and nothing the site does will prevent it. However, CSP configurations are generally part of a defense in depth strategy - ...
Matthew's user avatar
  • 27.3k
12 votes

Is storing authentication tokens in local storage with a strong CSP safe?

... prohibits all JS except the one I bundle my app, XSS attacks should be essentially impossible This assumes that your (trusted) JS is free from exploitable bugs. ... is there still a security ...
Steffen Ullrich's user avatar
11 votes
Accepted

How does a trusted maps.googleapis.com in CSP enable an XSS vulnerability? (JSONP)

Consider if something like this was attempted by an attacker injecting XSS: <script src="https://maps.googleapis.com/foo?callback=alert"></script> This would execute the foo function ...
SilverlightFox's user avatar
11 votes
Accepted

Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?

Chrome tells you it knows the directive but the browser is currently configured to ignore it, no matter if it would be applied or not. SRI (Subresource Integrity), as a W3C Recommendation, is from ...
Michal Špaček's user avatar
9 votes
Accepted

Is Content Security Policy only enforced during initial rendering?

Introduction CSP should be enforced by the browser as long as you stay on the page, and not just while it is originally loaded or rendered. Everything else would make it quite toothless. So the ...
Anders's user avatar
  • 65.6k
9 votes
Accepted

Is CSP meant to be used with HTTPS (TLS) only?

It depends on what the attacker is able to do. As you know, it's possible for a HTTP request / response to be intercepted, and modified by an attacker. This attacker can then alter the response to ...
Benoit Esnard's user avatar
8 votes
Accepted

Does CSP block javascript in <a href> tags?

Your question can be answered with a simple test using some local HTML file: <meta http-equiv="Content-Security-Policy" content="script-src 'self'"> <a href="javascript:alert('test')">...
Steffen Ullrich's user avatar
7 votes

Extremist influence in the management of Wikipedia

This is a misconception as described here. Also to make major contributions you need credit as a reputable editor. Here is a great description of the bots and volunteers that keep Wiki tidy Also it'...
J.A.K.'s user avatar
  • 4,843
7 votes

What are the limitations of Content Security Policy?

However, it would still be possible to alter the data on the screen in unexpected ways, and possible to create a convincing Phishing scam by providing a link out to another website. Is this ...
oreoshake's user avatar
  • 309
7 votes

CSP allowing all Google domains?

I hope that Google reads this too, they should change GoogleAds and Google Analytics by serving these images from ar.images.google.com and be.images.google.com, then we can set up our CSP using image-...
bbaassssiiee's user avatar
7 votes
Accepted

Content Security Policy Style Hash

It looks like that with Chrome (but not Firefox) you also need to explicitly allow 'unsafe-hashes' since giving the hashes alone seem to apply only for script and style sections and not attributes. ...
Steffen Ullrich's user avatar
7 votes

What was the real reason for dropping reflected-xss directive from CSP?

I think the Mozilla link you provide has enough in it to answer your question (quotes taken out of order from the thread so I can tell a better story): Firefox could do better using a (probably ...
Mike Ounsworth's user avatar
7 votes
Accepted

Content Security Policy https: and data: meaning

Content-Security-Policy: img-src 'self' https: data:; I would read that out loud as "images can be loaded from the current domain, or any https:// url, or are data:// url". So having https:...
Mike Ounsworth's user avatar
6 votes
Accepted

Can you exploit an XSS vulnerability on one page to run code on another page?

The attacker could add some onclick event attribute on the different link of the page. When the user click on a link, he'll think he got a simple disconnection bug, instead of that, you're onclick ...
Xavier59's user avatar
  • 2,924
6 votes
Accepted

Why are inline scripts and styles considered not secure under content security policy?

So why not allow inline JS? Because that would negate the whole benefit of a CSP! The goal is to stop XSS - injection of eg. JS into a HTML page. Since it is near impossible to distinguish between ...
Anders's user avatar
  • 65.6k
6 votes
Accepted

Is allowing blob: in Content-Security-Policy a risk?

A blob represents file-like data in client's memory (it may also be backed up by a temporary file). That data can be loaded or saved using JavaScript commands, including loaded/saved to a local file ...
Alexis Wilke's user avatar
  • 1,007
6 votes
Accepted

What's the alternative of content security policy (CSP) header in Internet Explorer IE?

MDN - Content Security Policy (CSP) - Browser Compatibility shows what is supported in MSIE and what not. To summarize: MSIE only supports the sandbox flag MSIE only supports the old X-Content-...
Steffen Ullrich's user avatar
6 votes
Accepted

How do I control multiply-nested embedding of my iframe?

CSP frame-ancestors already does what you want. Content-Security-Policy: frame-ancestors [...] checks the entire ancestor chain. If any parent document doesn't match the source whitelist, your ...
Arminius's user avatar
  • 44.8k
6 votes

Does allowing unsafe-inline script defeat the purpose of CSP?

Won't whitelisting unsafe-inline and unsafe-eval kind of defeat the whole CSP? Yes. A tight CSP will make it harder to exploit XSS by restricting the scripts that can be executed. Using unsafe-...
Sjoerd's user avatar
  • 30.7k
6 votes

Is storing authentication tokens in local storage with a strong CSP safe?

I would not place that much trust in CSP to be honest. I'm currently trying to tighten the CSP headers on a reasonably complex project. Some issues I'd worry about: Third party components may require ...
marcelm's user avatar
  • 1,008
5 votes

What is an inline script?

An inline script is a script that is not loaded from an external file, but embedded inside HTML. For example, these are inline scripts: <script>alert(1);</script> <img src=x onerror=...
tim's user avatar
  • 29.6k
5 votes

CSP allowing all Google domains?

The problem here isn't with your CSP, but more to do with how the aims of CSP and Google Analytics and similar tracking systems are at odds with one another. The Content-Security-Policy header was ...
Matthew's user avatar
  • 27.3k
5 votes

Can I trust public code versioning platforms when building a social platform?

There are multiple options except for Gitlab (including pure Git). Gitlab is an open-source/open code project so that you can install it on your private server, so nobody except your team have access. ...
Maxim Kuleshov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible