33

When implementing csp-header, I have specified my policy as: default-src 'self'; script-src www.gstatic.com; Since I have not declared script-src-elem directive in my csp policy, as stated in this mdn documentation, I was expecting policy defined for script-src to be used for script-src-elem directive as well. However, I see violation being reported as "violated-directive":"script-src-elem" "blocked-uri":"https://www.gstatic.com/blah/blah".

Any idea why this behavior is happening?

5
  • Do you know which specific browsers (and versions) you have been seeing this happen with? I have been trying to track down this exact same issue, and I'm wondering if perhaps there is a browser defect causing it. In my case, I have https://www.google-analytics.com in my script-src whitelist, and I am seeing script-src-elem reports come in for that uri. I have no script-src-elem directive, so it should be falling back to the script-src which allows that uri.... As far as I can tell, it should not be getting blocked or reported at all. Commented Oct 13, 2020 at 14:38
  • @MattMetzger - our logs didn't have the browser information included with the violation report. I haven't had time to explore the theory doublesharp gave in the answer below that these violations could be happening because scripts are being injected based on js events, but that sounds interesting to me.
    – haku
    Commented Oct 14, 2020 at 20:14
  • @anish : How did you resolve this issue ? We are facing same issue in our application. Even though we have mentioned connect-src self and script-src self, we are still seeing some CSP violation reports from same orign/host. Will be really helpful if you let us know how you resolved this. Commented Dec 8, 2020 at 6:17
  • @YathishManjunath - we never resolved it. It was a small portion of the violation report we were getting so we are living with the issue and we are still blocking them. It just doesn't happen very often and none of our customers have complained anything so... have you looked into what doublesharp had to say? something about the scripts may be injected by javascript event
    – haku
    Commented Dec 8, 2020 at 22:57
  • I've seen this same problem with Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36 which I think is Chrome 88.0 on Windows 7. Commented Feb 4, 2021 at 12:23

4 Answers 4

41

After seeing this exact same pattern in some of my applications, I finally got to the root of this!

The weirdness we were seeing was that CSP reports were coming in for a hostname which was definitely in the script-src directive; and we know that script-src-elem is supposed to fall back to those directives. From that perspective, it should have been literally impossible for these reports to happen.

Here's what we found: the users these reports were coming from were using the PrivacyBadger browser extension, which was leading to false positive CSP reports for the hosts (Google) that it blocked. I didn't dig too far into it, but here's my theory on how that happens:

  1. The Content Security Policy performs a pre-request check for the JavaScript include on the page (eg. gstatic.com or google-analytics.com). The pre-request check passes, because the hostname is allowed in the policy.
  2. The browser initiates a request for the resource
  3. PrivacyBadger intercepts the request via the browser's onBeforeRequest API (see PrivacyBadger source and Chrome documentation)
  4. ProvacyBadger returns a surrogate data blob for the asset. It does this to ensure that code which relies on the real javascript (eg. window.ga) won't break.
  5. The browser then performs a post-request check against the returned base64 blob
  6. The post-request check fails - because the policy does not allow data: for script-src
  7. The browser sends a CSP report for the blocked asset.

This seems like it might be a browser bug - because the report reflects the original asset's third party hostname; while the blocked content is actually a data: blob that was returned via the intercepted request.

5
  • 2
    I think you might be on to something here. I am seeing the same behavior for track.adform.net although my CSP allows *.adform.net and also data:. I am only seeing reports from some Chrome instances on Windows. No other browsers and no other OS.
    – span
    Commented Dec 7, 2020 at 10:32
  • Related bug report: bugs.chromium.org/p/chromium/issues/detail?id=880816
    – span
    Commented Dec 7, 2020 at 20:56
  • @Span : We are facing same issue in our application. Even though we have mentioned connect-src 'self' and script-src 'self', we are still seeing some CSP violation reports from same orign/host for connect-src and script-src-elem. We are now blocked to rollout in enforce mode. I checked the link which you have mentioned in comment. I don't see anything related to this issue mentioned in bug report. Commented Dec 8, 2020 at 6:47
  • 2
    I find it funny that PrivacyBadger causes extra tracking information to be sent in form of CSP violation report. Commented Feb 4, 2021 at 12:43
  • 1
    Is anyone able to reproduce the issue with PrivacyBadger? I'm trying to track down this same issue, and I tried several ad-blocking and privacy extensions, but they all seem to block these resources without triggering CSP violations. Commented Jul 12, 2021 at 20:13
1

From the documentation you linked to: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem

The HTTP Content-Security-Policy (CSP) script-src-elem directive specifies valid sources for JavaScript elements, but not inline script event handlers like onclick.

Without seeing the rest of your code it is a safe assumption that you are seeing this error as a result of an inline event handler and will need to define script-src-elem in your CSP policy.

5
  • That makes sense. Thank-you doublesharp. Let me play around to validate that.
    – haku
    Commented Oct 12, 2020 at 17:27
  • 1
    That didn't work. Although the script-src-elem is not applicable to inline scripts, script-src directive is. Since I declared script-src directive in my csp policy, getting the violation report for an allowed source for script-src-elem still doesn't make sense...
    – haku
    Commented Oct 12, 2020 at 17:41
  • Are you saying that adding script-src-elem results in the same error? Can you include the code that is triggering it? Google scripts often update the dom so it might not be obvious where the source of the error is. Commented Oct 12, 2020 at 17:47
  • 1
    No, I didn't mean that. I don't have script-src-elem directive defined at all in my csp-policy. I only have script-src directive which has a list of allowed sources. Based on the mdn documentation, if I have allowed a source in script-src and do not have script-src-elem defined, script-src-elem should allow sources allowed by script-src. I am not seeing this behavior. I can't post the actual code, but I have posted miniature version of my csp policy and violation report I am seeing in the question.
    – haku
    Commented Oct 12, 2020 at 17:57
  • @anish I think the documentation is saying that will be true unless the script is added by a javascript event, which i think is what is happening in your case. What is the full URL in the error? Commented Oct 12, 2020 at 23:43
1
  1. script-src-elem definitely does fallback to script-src in browsers on the Chromium engine. Check the Chrome console, the warn will looks like: ... Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Gecko-browsers does not support script-src-elem and use script-src directly.

The CSP2-browsers in violation reports sends a violatied directive resulting after all fallback chain. But CSP3-browsers send a "theoretically" violated directive and than perform fallback if directive was omitted. This introduces some confusion.

  1. script-src-elem have nothing to do with inline event handler like onClick() -this is noted in MDN docs. script-src-elem controls only <script>...</script> and <script src='...'> elements (and javascript-navigation). "blocked-uri":"https://www.gstatic.com/blah/blah" says that https://www.gstatic.com host-source was blocked, not inline event handler.

Inline event handlers do lock in the script-src-attr directive and report will looks like "blocked-uri":"inline".

Looks like you edit a copy CSP, but server issues another as default. Please look the "original-policy" filed in the report's JSON. Is it contains you real CSP or some default one?

PS: To detail analyse what's going on it need to look a full violation report and a your full CSP (print screen of browser console messages will be very helpful). Because script-src www.gstatic.com; is totally enough for CSP3-browsers to allow any resources from 'https://www.gstatic.com'. (CSP2-browsers requires more rules but you shown violation report sent by CSP3-browser).

2
  • Can you please point to the CSP2 and CSP3 documentation for what you have mentioned that "CSP2-browsers in violation reports sends a violatied directive resulting after all fallback chain. But CSP3-browsers send a "theoretically" violated directive and than perform fallback". Commented Dec 8, 2020 at 5:44
  • 1
    violated-directive in CSP2 if fallback. In CSP3, info is scattered throughout the spec, but violated-directive = effective-directive in CSP3. You can look at live demo in Firefox and Chrome. FF does send a really violated directive, but Chrome sends effective-directive where violation should occurred if such directive will be presented in the policy.
    – granty
    Commented Dec 8, 2020 at 12:36
0

The solution for my case:

Disable the NoScript-Addon in Chrome.

2
  • Will you please elaborate on that? I mean how and where ? Is it a code or something to be done on Settings ? Commented Aug 25, 2022 at 16:17
  • NoScript is an AddOn which you might have installed in Chrome. It blocks the execution of certain scripts.
    – Thomas
    Commented Sep 4, 2022 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.