inline event handler nested within a javascript - Refused to execute inline event handler because it violates the following Content Security Policy

Question

Preface: Hashes belonging to all known or identifiable Javascripts have been included in the CSP Header.

When I click on the custom Facebook share button, I get the following error:

Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src..."

From within the browser console I see that the error refers to a generic <! DOCTYPE html> X which is in the HTML page where external Javascripts are called.

It looks like the called inline event handler is nested within a Javascript (this Javascript has its own hash in the CSP header and it is called from the HTML page bentioned above):

INLINE EVENT HANDLER:

var s = new Array('"#" onclick="window.open(\'//www.facebook.com/sharer/sharer.php?u=' + u + '\', \'_blank\', \'scrollbars=0, resizable=1, menubar=0, left=100, top=100, width=550, height=440, toolbar=0, status=0\');return false" title="share on example"');

var l = "";

for (j = 0; j < s.length; j++) l += '<a rel="noopener noreferrer" style="display:inline-block;vertical-align:bottom;width:32px;height:32px;margin: 10px 10px 10px 10px;padding:0;outline:none;background:url(' + f + fn + ") -" + 32 * j + 'px 0 no-repeat" href=' + s[j] + ' target="_blank"></a>';

e[k].innerHTML = '< span id="share" >' + l + "< /span >";

The event handler should open a new browser's window but it fails generating the error in the subject. However, it opens a new browser's tab reloading the same page (it does not open facebook.com).

If I disable the CSP in the header, everything works fine.

Unfortunately, I am unable to identify the exact inline event handler for generating the correct hash.

Is there any effective debugging tool or technic for tracing the precise code which is triggering the error, or any other way to resolve this issue?

ControlAltDel · Accepted Answer · 2023-09-25 15:31:27Z

0

Inline scripts/event handlers are dangerous in JavaScript and are implicitly outlawed if there is a Content-Security-Policy on the page. The way you can disable them is by adding

unsafe-inline

to script-src

But the best (safest) way to solve this is to not use inline event handlers and instead do this in your JavaScript libraries via

Element.addEventListener(...)

edited Sep 25, 2023 at 15:31

answered Sep 25, 2023 at 15:17

ControlAltDel

35.2k10 gold badges60 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Goemon Code Over a year ago

I know that the best way it would be to get rid of the inline event handler. However, this cannot be solved in a timely fashion, and I need a quick, temporary, fix. Please note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

Collectives™ on Stack Overflow

inline event handler nested within a javascript - Refused to execute inline event handler because it violates the following Content Security Policy

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related