script-src-elem
definitely does fallback to script-src
in browsers on the Chromium engine. Check the Chrome console, the warn will looks like:
... Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
Gecko-browsers does not support script-src-elem
and use script-src
directly.
The CSP2-browsers in violation reports sends a violatied directive resulting after all fallback chain. But CSP3-browsers send a "theoretically" violated directive and than perform fallback if directive was omitted. This introduces some confusion.
script-src-elem
have nothing to do with inline event handler like onClick() -this is noted in MDN docs. script-src-elem
controls only <script>...</script>
and <script src='...'>
elements (and javascript-navigation).
"blocked-uri":"https://www.gstatic.com/blah/blah"
says that https://www.gstatic.com
host-source was blocked, not inline event handler.
Inline event handlers do lock in the script-src-attr
directive and report will looks like "blocked-uri":"inline"
.
Looks like you edit a copy CSP, but server issues another as default. Please look the "original-policy" filed in the report's JSON. Is it contains you real CSP or some default one?
PS: To detail analyse what's going on it need to look a full violation report and a your full CSP (print screen of browser console messages will be very helpful). Because script-src www.gstatic.com;
is totally enough for CSP3-browsers to allow any resources from 'https://www.gstatic.com'. (CSP2-browsers requires more rules but you shown violation report sent by CSP3-browser).
https://www.google-analytics.com
in myscript-src
whitelist, and I am seeingscript-src-elem
reports come in for that uri. I have noscript-src-elem
directive, so it should be falling back to thescript-src
which allows that uri.... As far as I can tell, it should not be getting blocked or reported at all.Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36
which I think is Chrome 88.0 on Windows 7.