4 ms·
I've tried to get Content Security Policy (CSP) rolled out in our new development at work, and to be frank I'm starting to lose faith that it is workable. We'r
by UnoriginalGuy 12y ago
I've tried to get Content Security Policy (CSP) rolled out in our new development at work, and to be frank I'm starting to lose faith that it is workable.
We're on report only at the moment, and it seems like every major JavaScript library depends on Eval() in one way or another (mostly new function()).
Just this week someone wanted to use Angular (1.3.1) and it generates dozens of CSP reports without ng-csp in the HTML element, but when the attribute exists $http responses (which depend on function()) aren't working (e.g. success(function(data, status, headers, config) {}).
Unfortunately Angular's documentation on CSP is a single page with nothing particularly helpful, and tons of stackoverflow results about Google Chrome extension development.
This is just the tip of the iceberg. Seems like every single major JavaScript library (even things you just take for granted) break CSP or need tons of exceptions.
- homborg 12y agoAs far as I can tell, the are no issues with the `function` keyword in csp mode, but the `Function` constructor, eg. `Function("a", "console.log(a);")` Your example is a callback with an anonymous function. Do you have any links to discussions about your issue?
- AgentME 12y agoJust turn on CSP's unsafe-eval option. You still get the XSS attack prevention unless your code is doing something very silly already and eval'ing stuff from the DOM.