Problem/Motivation

When loading a node edit page with a paragraph field, which includes am editor enabled text area using the Paragraphs Classic widget, it does not seem to detect that CKEditor is being used, and fails to take the measures add the unsafe-inline CSP option.

This can be mitigated by allowing "unsafe-inline" globally for the "script-src-attr" setting. Which is not ideal.

I'm not sure what this module's policy is for supporting other modules, but Paragraphs is pretty common.

Steps to reproduce

* Install Paragraphs.
* Add a Paragraph field to a node, use the "Classic widget" and set the edit mode to closed.
* Create a node. with a paragraph that includes a CKEditor enabled text field.

Proposed resolution

...

Remaining tasks

...

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#9 3164287-9-paragraphs-1.13.patch3.75 KBnixou
#8 csp_paragraphs.patch604 bytesrfmarcelino
#7 paragraphs-1.12-csp.patch3.65 KBnixou
#7 interdiff-6-7.txt699 bytesnixou
#7 paragraphs-dev-csp.patch3.63 KBnixou
#6 paragraphs-csp.patch3.61 KBgapple
#5 3164287-add-unsafe-inline-when-paragraph-libraries.patch1.77 KBcaco_d25

Comments

bburg created an issue. See original summary.

gapple’s picture

gapple
he/they
Primary language English
commented

It sounds like this should be covered as part of supporting core modules - I'll have to look into why it's not properly detecting the ckeditor library on the page.

If it's a unique solution for paragraphs, then it will be up to paragraphs to implement the csp API.

gapple’s picture

gapple
he/they
Primary language English
commented

This is an issue with things that load through AJAX - the original page needs a policy that allows any markup & libraries that will be returned in an AJAX request, but can't generically know what will be loaded later by the page.

In core this occurs with quickedit, which may load CKEditor on the page after an AJAX request, so CSP adds script-src-attr 'unsafe-inline' without knowing for sure if it will be needed or not.

Paragraphs could do similar, enabling 'unsafe-inline' when a form includes a paragraphs field, or more selectively only when the paragraph type includes a formatted text field.

bburg’s picture

bburg
he/him
Location Washington, DC
commented

Sounds like this should be a Paragraphs issue then. Shall we re-assign the issue to that project?

caco_d25’s picture

caco_d25 commented
Status: Active » Needs review
StatusFileSize
new 3164287-add-unsafe-inline-when-paragraph-libraries.patch1.77 KB

This patch changes the CSP policy for paragraph libraries

gapple’s picture

gapple
he/they
Primary language English
commented
StatusFileSize
new paragraphs-csp.patch3.61 KB

Those libraries potentially make it a lot easier than having to alter based on form fields.

Here's a patch that moves the logic to an event listener in the paragraphs module. I'd appreciate some feedback, and if this works sufficiently I'll open an issue on the paragraphs module with this patch.

nixou’s picture

nixou commented
StatusFileSize
new paragraphs-dev-csp.patch3.63 KB
new interdiff-6-7.txt699 bytes
new paragraphs-1.12-csp.patch3.65 KB

The paragraphs patch is working only if script-src-elem is set to [Csp::POLICY_UNSAFE_INLINE] as well.

I attach two patch with this fix :

  • The first is for the current development version of the Paragraphs module
  • The second is for the current stable version of the Paragraphs module
rfmarcelino’s picture

rfmarcelino commented
StatusFileSize
new csp_paragraphs.patch604 bytes

Re-roll #7

nixou’s picture

nixou commented
StatusFileSize
new 3164287-9-paragraphs-1.13.patch3.75 KB
gapple’s picture

gapple
he/they
Primary language English
commented
Status: Needs review » Closed (outdated)

Since Drupal 9 / CKEditor 4 are no longer supported, I'm closing this as outdated.

Please reopen with any relevant Drupal 10 / CKE5 info if this is still an issue.