8000 [WebProfilerBundle] CSP still blocks style · Issue #20963 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content
8000

[WebProfilerBundle] CSP still blocks style #20963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
cs278 opened this issue Dec 16, 2016 · 5 comments
Closed

[WebProfilerBundle] CSP still blocks style #20963

cs278 opened this issue Dec 16, 2016 · 5 comments
Labels
Bug WebProfilerBundle

Comments

@cs278
Copy link
Contributor
cs278 commented Dec 16, 2016
Q A
Bug report? yes
Feature request? no
BC Break report? no
RFC? no
Symfony version 3.2.0

Unless I'm missing something #18568 doesn't fully fix the compatibility of the toolbar with content security policy, JS works fine but the toolbar CSS is blocked.

The reason is the CSS is injected from an XHR request and so has a different nonce than the one set in the CSP header.

A solution that works is to move the CSS into the toolbar_js.html.twig view.

I've prepared a branch with a few test actions to illustrate the problem:

symfony/symfony-standard@master...cs278:broken-csp
@tgabi333
Copy link
Contributor

+1

@fox-hellraiser fox-hellraiser mentioned this issue Mar 18, 2017
Closed
@romainneutron
Copy link
Contributor

Could you please provide the violation?
In which page?

@cs278
Copy link
Contributor Author
cs278 commented Mar 19, 2017

@romainneutron I don't have this to hand and probably won't get chance to look at it for a few weeks.

The CSP violation appears on pages rendering the toolbar (not the profiler pages themselves) that have a style-src: hash-/nonce- rule, the message is nonce mismatch or something to that effect.

@romainneutron romainneutron mentioned this issue Mar 21, 2017
Merged
@romainneutron
Copy link
Contributor

I just submitted a patch that solves your issue. Thanks for reporting

fabpot added a commit that referenced this issue Mar 21, 2017
@fabpot
bug #22090 [WebProfilerBundle] Fix Content-Security-Policy compatibil…
74a1cc3 
…ity in case of a `style-src 'self'` policy (romainneutron)

This PR was merged into the 3.2 branch.

Discussion
----------

[WebProfilerBundle] Fix Content-Security-Policy compatibility in case of a `style-src 'self'` policy

| Q             | A
| ------------- | ---
| Branch?       | 3.2 <!-- see comment below -->
| Bug fix?      | yes
| New feature?  | no <!-- don't forget updating src/**/CHANGELOG.md files -->
| BC breaks?    | no
| Deprecations? | no <!-- don't forget updating UPGRADE-*.md files -->
| Tests pass?   | yes
| Fixed tickets | #22053 #20963
| License       | MIT

This fixes the compatibility of the bundle in case of a `style-src 'self'` policy.
This PR must be rebased once #22089 is merged

Commits
-------

4acec89 [WebProfilerBundle] Fix content-security-policy compatibility
@fabpot fabpot closed this as completed Mar 21, 2017
@cs278
Copy link
Contributor Author
cs278 commented Mar 21, 2017

I just submitted a patch that solves your issue. Thanks for reporting

That looks like what I did locally when testing, so should solve the problem for me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug WebProfilerBundle
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@cs278 @fabpot @javiereguiluz @romainneutron @tgabi333 @carsonbot
0