Currently hashes are registered to apply to a particular directive, and set on only that directive (if it is enabled). If a fallback for that directive is enabled, but not the directive itself, the hashes are not set when they should be.

e.g. default-src 'self' should result in default-src 'self'; script-src 'self' 'hash-123abc'

CSP has a proposed helper function in #3099423: Helper for altering directives with fallback

CommentFileSizeAuthor
#3 attachinline-3099536-3.patch2.15 KBgapple

Comments

gapple created an issue. See original summary.

gapple’s picture

gapple
he/they
Primary language English
commented

Helper function isn't itself useful, because this module needs to consider if 'unsafe-inline' is set, but can be copied to a local helper with the necessary modifications.

gapple’s picture

gapple
he/they
Primary language English
commented
Status: Active » Needs review
Issue tags: +Needs tests
StatusFileSize
new attachinline-3099536-3.patch2.15 KB

  • gapple committed c874551 on 8.x-1.x 
    Issue #3099536: Consider fallback CSP directives when adding hashes
gapple’s picture

gapple
he/they
Primary language English
commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.