Unsafe-inline is used in Kirby 3.6 Panel making login view not render under CSP

[anselmh]

Describe the bug

I think I just found an issue some days after upgrading one of the Kirby sites to 3.6. The site uses a Content-Security-Policy (CSP) defined in Apache via .htaccess file and it forbids unsafe-inline for obvious reasons.

It worked fine until the user session expired in Panel, then the client realised that the login view doesn’t render anymore. I debugged it a bit and found the following errors logged to the console:

Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy

TypeError: undefined is not an object (evaluating 'window.panel.$urls.api')

I reached the source and found some scripts (one, ) not using a hash/nonce but am not entirely sure which one causes the issues. I currently made my CSP unsafe by allowing the unsafe-inline scripts but this can only be a temporary solution.

To Reproduce
Steps to reproduce the behavior:

1. Set up a CSP that doesn’t allow unsafe-inline scripts
2. Try to login to the Kirby panel
3. See nothing rendered and CSP errors reported

Expected behavior
Login view renders without CSP issues and without using unsafe-inline scripts.

Kirby Version
3.6.0

Additional information I also tried to only set unsafe-hashes instead of unsafe-inline but it doesn’t work so I assume either a hash/nonce doesn’t work correctly or there is some script relying on a real unsafe inline script causing this error.

[anselmh]

Additionally, there’s also a base64-data-image used as placeholder in the panel which causes a CSP report/error unless you set image-src: data: which is nearly as unsafe as unsafe-inline for scripts. Should I create a different ticket for this?

[bastianallgeier]

You can solve this by using our nonce for the CSP header. But you need to move setting the header to your config instead of the htaccess.

<?php 

return [
  'ready' => function ($kirby) {
    header("Content-Security-Policy: script-src 'nonce-" . $kirby->nonce() . "'");
  }
];

The first script block will still throw an error and I will fix that in 3.6.1

[bastianallgeier]

✅