adding nonce to script tag for 3rd party code that breaks 'unsafe-eval'

Question

We are using netlify-cms that unfortunately emits code that break CONTENT-SECURITY-POLICY 'unsafe-eval'.

I have tried adding nonce attributes to all the script tags using nginx sub_filter:

server {
  listen       80;
  set_secure_random_alphanum $cspNonce 32;
  sub_filter_once off;
  sub_filter_types *;
  sub_filter *CSP_NONCE* $cspNonce;
  sub_filter '<script' '<script nonce=\'$cspNonce\' ';
  sub_filter '<link' '<link nonce="$cspNonce" ';

I then add the nonce to the header also

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$cspNonce' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' petstore.swagger.io;connect-src 'self' petstore.swagger.io";

I can see that the nonces in the script tags and the header all match:

<script nonce='72UTQMpuXxfwcevvTydWt8XvOSzKhhjM' >

header

Content-Security-Policy default-src 'self'; script-src 'self' 'nonce-77Fdz6e1aBiGr5b8qcReeUgkO2NtJnSm'

But I still get the error message:

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'nonce-77Fdz6e1aBiGr5b8qcReeUgkO2NtJnSm'

granty · Accepted Answer · 2021-12-02 20:48:58Z

2

By using 'nonce-value' you can get rid of 'unsafe-inline' only, but not of 'unsafe-eval'.

'unsafe-eval' in Netlify is required to compile JSON to JS code, but you can get rid of 'unsafe-eval' too. Just update ajv-json-loader to use AJV 7 and Standalone mode and configure webpack config to use the updated loader. See nitty-gritty here.

answered Dec 2, 2021 at 20:48

granty

8,7701 gold badge21 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

dagda1 Over a year ago

Thank you for the answer. Do you mean that nonce-value is only good for unsafe-inline?

granty Over a year ago

Yes, 'nonce-value' (and 'hash-value') are applied to inline scripts and external scripts/styles. So they can be used to get rid of 'unsafe-inline' in scrips-src and style-src. Whereas 'unsafe-eval' covers creation functions from strings using eval() / new Function() / setTimeout('string', ) / setInterval('string', ). 'unsafe-eval' acts as a global page flag so it cannot be applied selectively.

Collectives™ on Stack Overflow

adding nonce to script tag for 3rd party code that breaks 'unsafe-eval'

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related