Skip to content

unsafe-eval required in content security policy for profiling toolbar in Symfony 4.1 #27583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
rpkamp opened this issue Jun 12, 2018 · 4 comments
Closed

unsafe-eval required in content security policy for profiling toolbar in Symfony 4.1 #27583

rpkamp opened this issue Jun 12, 2018 · 4 comments
Labels
Bug Status: Needs Review WebProfilerBundle

Comments

@rpkamp
Copy link
Contributor

rpkamp commented Jun 12, 2018

Symfony version(s) affected: 4.1.0

Description
Commit 0cd51ae added a call to Javascript's eval function, which is not allowed under a strict content security policy. We have this strict policy on development as well in production because we don't want to find out about CSP violations in production only.

How to reproduce
Open a webpage with the Symfony profiling toolbar while CSP is enabled and unsafe-eval is not allowed

Possible Solution
It would be best if eval wouldn't be needed at all, but I'm not sure if that's an option
@rpkamp rpkamp changed the title unsafe-eval required for profiling toolbar in Symfony 4.1 unsafe-eval required in content security policy for profiling toolbar in Symfony 4.1 Jun 12, 2018
@stof
Copy link
Member

stof commented Jun 12, 2018

@ogizanagi the change in this commit is that the eval call is always performed, instead of being performed only when having some JS in the panels. So the issue is not new, but it is much more common now.

@rpkamp
Copy link
Contributor Author

rpkamp commented Jun 12, 2018

Ah yes, checking if there are any scripts and only run eval if that is the case would solve this issue for me.

@stof stof mentioned this issue Jun 12, 2018
Merged
@stof
Copy link
Member

stof commented Jun 12, 2018

@rpkamp see #27584

@rpkamp
Copy link
Contributor Author

rpkamp commented Jun 12, 2018

@stof cool, thanks!

fabpot added a commit that referenced this issue Jun 13, 2018
@fabpot
bug #27584 Avoid calling eval when there is no script embedded in the…
fb4c79b 
… toolbar (stof)

This PR was merged into the 4.1 branch.

Discussion
----------

Avoid calling eval when there is no script embedded in the toolbar

| Q             | A
| ------------- | ---
| Branch?       | 4.1
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #27583
| License       | MIT
| Doc PR        | n/a

#27189 changed the way embedded scripts were eval'd for the toolbar. But it also refactored the code in a way triggering `eval` all the time, even when there is no embedded script, which was reported several times as an issue with CSP.

While the debug panel (showing dumps) still requires having `unsafe-eval` in the CSP header (due to embedding scripts that we eval), this PR reverts back to the behavior of Symfony 4.0 and older, where only toolbars actually embedding scripts have this CSP compat issue.

Commits
-------

a0f78a5 Avoid calling eval when there is no script embedded in the toolbar
@fabpot fabpot closed this as completed Jun 13, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Status: Needs Review WebProfilerBundle
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@fabpot @stof @rpkamp @xabbuh @carsonbot