Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: CSP autoNonce = false #6570

Merged
merged 3 commits into from
Sep 23, 2022
Merged

fix: CSP autoNonce = false #6570

merged 3 commits into from
Sep 23, 2022

Conversation

kenjis
Copy link
Member

@kenjis kenjis commented Sep 23, 2022 •
edited
Loading

Description
From https://forum.codeigniter.com/showthread.php?tid=83041

Manual Testing

<?php

namespace App\Controllers;

class Home extends BaseController
{
    public function index()
    {
        return "<html><script>alert('XSS');</script></html>";
    }
}
diff --git a/app/Config/App.php b/app/Config/App.php
index 79e5741b4..7b56cf601 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -462,5 +462,5 @@ class App extends BaseConfig
      *
      * @var bool
      */
-    public $CSPEnabled = false;
+    public $CSPEnabled = true;
 }
diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php
index 0be616301..ff1361ffe 100644
--- a/app/Config/ContentSecurityPolicy.php
+++ b/app/Config/ContentSecurityPolicy.php
@@ -184,5 +184,5 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var bool
      */
-    public $autoNonce = true;
+    public $autoNonce = false;
 }

Navigate http://localhost:8080/, and you don't see the alert.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@kenjis kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Sep 23, 2022
@kenjis kenjis merged commit 83fc0f9 into codeigniter4:develop Sep 23, 2022
@kenjis kenjis deleted the fix-csp-autoNonce branch September 23, 2022 23:13
@ddevsr ddevsr mentioned this pull request Nov 17, 2022
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lonnieezell lonnieezell lonnieezell approved these changes

@MGatner MGatner MGatner approved these changes

Assignees
No one assigned
Labels
bug Verified issues on the current code behavior or pull requests that will fix them
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@kenjis @lonnieezell @MGatner