1

I am trying to understand why I am getting a Content Security Policy report of a connect-src violation from Chrome only (not Firefox) for the case where Javascript executes something like:

somediv.innerHTML = "...<img src='https://thirdpartysite/someimage.jpg'>..."

in a window.onbeforeunload handler.

I have made a little demo of the problem here: https://testcsp.savesnine.info/ . This assigns some HTML with an img element with a third-party src in both a window.onload handler (so the image shows up on page load) and in window.onbeforeunload. The onload assignment does not fire CSP, but the onbeforeunload does.

It is also firing on connect-src not img-src (I have set the img-src to allow third-party images, but not connect-src, and I don't believe I should need to, and in any case that would defeat the point). You can see the CSP header and the CSP report firing from the Chrome debugger (when you go to a different web page - it needs Preserve Log on for the console to see it, or on Network for the report being sent to /csp.php). The CSP header is:

default-src 'self';style-src 'self';img-src 'self' https:;script-src 'self';connect-src 'self';font-src chrome-extension: moz-extension: safari-extension: data:;report-uri /csp.php

This is an artifical example, but the real problem arose from a hard to diagnose CSP report which seemed to happen some minutes after people finished with the web page it happened on (according to my log files). I eventually worked out that it came from the tinymce editor when they closed the browser page (or went elsewhere), which sets a onbeforeunload handler to write the HTML it has been editing (containing third-party images, but allowed by img-src) back into the original container element the content came from.

I think I have the correct CSP for my case here, so it may be a Chrome bug, but equally I may have misunderstood something about CSP.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.