1

When using the report-only mode of the Content-Security-Policy, Chrome does not execute eval() anymore.

For the following example, I would expect to get 2 reports (one for the inline-script and one for the eval) and also, to see a pop-up. But only the 2 reports are displayed in the console.

Do I use the CSP wrong or is there a bug with the CSP report-only mode in Chrome?

<!DOCTYPE html>
<html>
    <meta http-equiv="Content-Security-Policy-Report-Only"   content="default-src 'self'; report-uri /dummy.html"/>     
    <meta http-equiv="X-Content-Security-Policy-Report-Only" content="default-src 'self'; report-uri /dummy.html"/>     
    <meta http-equiv="X-WebKit-CSP-Report-Only"              content="default-src 'self'; report-uri /dummy.html"/>
    <head>
        <script>
            eval('alert(1);');  
        </script>
    </head>
</html>

1 Answer 1

1

I can replicate this, and I've filed https://bugs.webkit.org/show_bug.cgi?id=111867. I'll have a fix in shortly. It's straightforward oversight on my part. Sorry about that.

1
  • 1
    Hi Mike, I tried this again with Chrome27 (27.0.1453.93m) and things are slightly better: eval() is now executed in report-only mode - but no longer reported in the console. May 21, 2013 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.