Kryptronic Software Support Forum

It seems that websites should have a content security policy to make applications more secure against common web vulnerabilities, particularly cross-site scripting. It is enabled by setting the Content-Security-Policy HTTP response header.

There is info at https://csp.withgoogle.com/docs/adopting-csp.html

I installed the CSP Mitigator Chrome extension and found a number of issues. Are you working on this in K902?

The issues reported:

Fix: Refactor any markup with inline event handlers and javascript: URIs.

Refactor inline event handlers and javascript: URIs
Inline event handlers (onclick="...", onerror="...") and <a href="javascript:..."> links can be used to run scripts, so an attacker who finds an XSS bug could inject such HTML and execute malicious JavaScript. CSP requires refactoring such markup into safer alternatives.

In most cases the changes will be straightforward. To refactor event handlers, rewrite them to be added from a JavaScript block:

<script> function doThings() { ... } </script>
<span onclick="doThings();">A thing.</span>
should become:

<span id="things">A thing.</span>

<script nonce="${nonce}">
document.addEventListener('DOMContentReady', function () {
  document.getElementById('things')
    .addEventListener('click', function doThings() { ... });
});
</script>
For javascript: URIs, you can use a similar pattern:

<a href="javascript:linkClicked()">foo</a>
into

<a id="foo">foo</a>

<script nonce="${nonce}">
document.addEventListener('DOMContentReady', function () {
  document.getElementById('foo')
    .addEventListener('click', linkClicked);
});
</script>
Ideally, these scripts should be "outlined" into separate .js files; this gives you the benefit of being able to compile/lint such code.


Debugging information
FYI: No enforcing CSP header was detected in any of the analyzed content.
FYI: No report-only CSP header was detected in any of the analyzed content.
No CSP nonces were detected in any of the analyzed content. Most applications should use nonces to allow trusted scripts to execute.
No 'strict-dynamic' usage was detected in any of the analyzed content. You should consider using a strict CSP policy.

Last edited by sdn (07-03-2017 08:33:29)