[WebProfilerBundle] Handle 'unsafe-eval' in CSP #27525
Conversation
|
your change is broken here. The handling of
So you should handle it separately instead of looping over On a side note, this should go in 3.4, not in 3.3 as this is not a security fix: https://symfony.com/roadmap/3.3 |
|
I see, I was not thinking that through.. So it cannot easily be "fixed" via nonce but just globally enabled instead which I also don't like (CSP errors not noticed in dev environment). Maybe the eval is now called in my case because of 0cd51ae |
|
The drawback of injecting I think the only place where we use |
In base_js_html.twig eval is used but the ContentSecurityPolicyHandler never adds 'unsafe-eval' to the nonce which breaks the profiler with very strict CSPs
I was using the profiler bundle with the very strict CSP "default-src 'self'; script-src 'self';" and the browser was not loading the toolbar because of CSP violations.
This change uses already existing functionality and loops through source values ("unsafe-inline" and "unsafe-eval") where before just "unsafe-inline" was used. I also adapted the unit tests for it, added new tests for edge cases and my case that failed. I honestly don't know if this is the best way to fix them / handle unsafe-eval, but this seems to be working fine for me.