Skip to content

fix: CSP autoNonce = false#6570

Merged
kenjis merged 3 commits into
codeigniter4:developfrom
kenjis:fix-csp-autoNonce
Sep 23, 2022
Merged

fix: CSP autoNonce = false#6570
kenjis merged 3 commits into
codeigniter4:developfrom
kenjis:fix-csp-autoNonce

Conversation

@kenjis

@kenjis kenjis commented Sep 23, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Description
From https://forum.codeigniter.com/showthread.php?tid=83041

Manual Testing

<?php

namespace App\Controllers;

class Home extends BaseController
{
    public function index()
    {
        return "<html><script>alert('XSS');</script></html>";
    }
}
diff --git a/app/Config/App.php b/app/Config/App.php
index 79e5741b4..7b56cf601 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -462,5 +462,5 @@ class App extends BaseConfig
      *
      * @var bool
      */
-    public $CSPEnabled = false;
+    public $CSPEnabled = true;
 }
diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php
index 0be616301..ff1361ffe 100644
--- a/app/Config/ContentSecurityPolicy.php
+++ b/app/Config/ContentSecurityPolicy.php
@@ -184,5 +184,5 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var bool
      */
-    public $autoNonce = true;
+    public $autoNonce = false;
 }

Navigate http://localhost:8080/, and you don't see the alert.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@kenjis kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Sep 23, 2022
@kenjis kenjis merged commit 83fc0f9 into codeigniter4:develop Sep 23, 2022
@kenjis kenjis deleted the fix-csp-autoNonce branch September 23, 2022 23:13
@ddevsr ddevsr mentioned this pull request Nov 17, 2022
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lonnieezell lonnieezell lonnieezell approved these changes
@MGatner MGatner MGatner approved these changes

Assignees

No one assigned

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kenjis @lonnieezell @MGatner