AdguardTeam / CoreLibs

Core Adguard libraries
https://adguard.com/
Apache License 2.0
40 stars 7 forks source link

AdGuard content script is blocked by CSP on uber.com #1903

Closed AdamWr closed 1 month ago

AdamWr commented 3 months ago

Please answer the following questions for yourself before submitting an issue

AdGuard version

7.18.0 nightly 13 (4795) (CL 1.16.8, DL 2.5.38 )

Browser version

Chrome

OS version

Windows 11

Issue Details

Steps to reproduce:

  1. Add these rules:
    uber.com##body
    uber.com#%#alert(1);
  2. Go to - https://www.uber.com/pl/pl/

Expected Behavior

Website should be blank and alert should be displayed.

Actual Behavior

Content script is blocked by CSP.

Screenshot ![image](https://github.com/user-attachments/assets/5120807f-ef39-40ed-9a0a-cd4d1fdbbea3)

Refused to load the script 'https://local.adguard.org/?ts=[...]' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https:[...]

Screenshots

No response

Additional Information

Website CSP: ``` ```

As a workaround uber.com$$meta can be used but I guess that it's not the best idea.