search

clancytom / u-ultimate.js

UulimateJS - A lighter web app framework
52 stars 5 forks source link

ngSanitize triggers CSP alert/report in Firefox #9

Open koaex opened 2 years ago

koaex commented 2 years ago

I'm submitting a ...

Current behavior:

If ngSanitize is added as a module dependency and a Content-Security-Policy is set that does not allow inline styles then Firefox shows the following message:

Content Security Policy: The page’s settings observed the loading of a resource at self (“default-src”). A CSP report is being sent.

Our CSP looks like this:

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /foo

If ngSanitize is removed from the module dependencies then the CSP message disappears as well.

Expected / new behavior:

ngSanitize should work in Firefox without triggering CSP alerts, at least if the "ng-csp" mode is enabled.

Minimal reproduction of the problem with instructions:

  1. Set the Content-Security-Policy to: default-src: 'self'
  2. Add 'ngSanitize' as a module dependency.

Browser: Firefox 60.0a1 and 59.0b10

Anything else: I guess the following code triggers the CSP alert, since it adds an inline <styletag. // Check for the Firefox bug - which prevents the inner img JS from being sanitized inertBodyElement.innerHTML = '<svg><p><style><img src="</style><img src=x onerror=alert(1)//">'; From: https://github.com/angular/angular.js/blob/master/src/ngSanitize/sanitize.js Line 443-444

koaex commented 2 years ago

If I understand correctly this is how it works right now:

  1. If Safari bug exists: Use getInertBodyElement_XHR
  2. Else if Firefox bug exists: Use getInertBodyElement_DOMParser
  3. Else: Use getInertBodyElement_InertDocument

Maybe it could be done like this instead?

  1. If Safari bug exists: Use getInertBodyElement_XHR
  2. Else if DOMParser is available: Use getInertBodyElement_DOMParser
  3. Else if Firefox bug exists: fail/throw/abort!
  4. Else: Use getInertBodyElement_InertDocument

This way, the Firefox CSP alert will not be triggered if DOMParser is available.

I guess this would mean that most browsers would use DOMParser instead of InertDocument. Are there any negative side effects of using DOMParser instead of InertDocument?