如何使用Undafe-Inline＆＃x27; vaadin中的内容 - 安全性？

发布于 2025-01-20 00:07:10 字数 758 浏览 3 评论 0原文

我正在使用vaadin开发一个应用程序，并且在引导流式列赛纳中使用内容 - 安全性。当我使用OWASP ZAP测试应用程序时，我对scripts-src'不安全inline'（中等风险）有问题。当我删除“不安全的内线”时，我的应用程序不起作用。

我的代码：

String csp = "";
String defaultSrc = "default-src 'none'";
String styleSrc = "style-src 'unsafe-inline' 'self'";
String fontSrc = "font-src 'self'";
String scriptSrc = "script-src 'unsafe-inline' 'unsafe-eval' 'self'";
String imgSrc = "img-src 'self'";
String connectSrc = "connect-src 'self'";
String frameAncestors = "frame-ancestors 'self'";
String formAction = "form-action 'self'";
csp = Arrays.asList(defaultSenter code hererc,styleSrc,fontSrc,scriptSrc,imgSrc,connectSrc,frameAncestors,formAction).stream().collect(Collectors.joining(";"));

原文

I am developing an application with Vaadin and I use Content-Security-Policy in my BootstrapListener. When I test my application with OWASP ZAP, I have problem with script-src 'unsafe-inline' (medium risk). When I delete the 'unsafe-inline', my application doesn't work.

My code:

String csp = "";
String defaultSrc = "default-src 'none'";
String styleSrc = "style-src 'unsafe-inline' 'self'";
String fontSrc = "font-src 'self'";
String scriptSrc = "script-src 'unsafe-inline' 'unsafe-eval' 'self'";
String imgSrc = "img-src 'self'";
String connectSrc = "connect-src 'self'";
String frameAncestors = "frame-ancestors 'self'";
String formAction = "form-action 'self'";
csp = Arrays.asList(defaultSenter code hererc,styleSrc,fontSrc,scriptSrc,imgSrc,connectSrc,frameAncestors,formAction).stream().collect(Collectors.joining(";"));

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

烟雨扶苏 2025-01-27 00:07:10

根据 Vaadin 文档使用 scriptSrc = "script-src 'unsafe-inline' 'unsafe-eval' 'self'"; 是已知的“限制”或如果不对框架进行重大修改，您就无法更改开发人员的架构选择：

设置 script-src 'unsafe-inline' 'unsafe-eval' 和 style-src
Vaadin 应用程序启动期间需要“unsafe-inline”，即
引导程序过程。启动的引导程序进程
应用程序加载小部件集，这是客户端引擎部分
的应用程序。这由预编译的 JavaScript 逻辑组成，用于
例如，对于通信协议、DOM 控件、按钮、
布局等，但不是应用程序代码。小部件集是
静态资源。加载后，客户端引擎需要
使用 JavaScript.eval() 开始。
因此，这些设置是 Vaadin 中的架构限制，因此
该框架可以在浏览器中启动其客户端引擎。
报告为：“Content-Security-Policy”标头丢失或不安全

XSS/代码注入安全方面，您可以做的（或可能已经做的）是使用内置转义用于输出：

Div div = new Div();

// These are safe as they treat the content as plain text
div.setText("<b>This won't be bolded</b>");
div.getElement().setText("<b>This won't be bolded either</b>");
div.setTitle("<b>This won't be bolded either</b>");

// These are NOT safe
div.getElement().setProperty("innerHTML", "<b>This IS bolded</b>");
div.add(new Html("<b>This IS bolded</b>"));

new Checkbox().setLabelAsHtml("<b>This is bolded too</b>");

和清理：

String safeHtml = Jsoup.clean(dangerousText, Whitelist.relaxed());
new Checkbox().setLabelAsHtml(safeHtml);

此外，这些被标记为是有原因的“不安全-”，问题是如果框架中存在缺陷或者您错过了转义，那么 CSP 无法区分注入的代码和原始代码。您应该始终通过将自己的安全脚本放入外部文件或使用 nonce 来“标记”您自己的安全脚本。

As per Vaadin documentation using scriptSrc = "script-src 'unsafe-inline' 'unsafe-eval' 'self'"; is a known "limitation" or architectural choice of the devs that you can't change without major modifications in the framework:

The settings script-src 'unsafe-inline' 'unsafe-eval' and style-src
'unsafe-inline' are required during Vaadin application start, that is,
the bootstrap process. The bootstrap process that starts the
application loads the widget set which is the client-side engine part
of the application. This consists of precompiled JavaScript logic, for
example, for the communication protocol, DOM control, Buttons,
Layouts, etc., but not the application code. The widget set is a
static resource. After it is loaded, the client-side engine needs to
be started using JavaScript.eval().
Hence, these settings are architectural limitations in Vaadin, so that
the framework can start its client-side engine in the browser.
Reported as: Missing or insecure “Content-Security-Policy” header

XSS/Code injection securitywise, what you can do (or may already did) is using the built in escaping for outputs:

Div div = new Div();

// These are safe as they treat the content as plain text
div.setText("<b>This won't be bolded</b>");
div.getElement().setText("<b>This won't be bolded either</b>");
div.setTitle("<b>This won't be bolded either</b>");

// These are NOT safe
div.getElement().setProperty("innerHTML", "<b>This IS bolded</b>");
div.add(new Html("<b>This IS bolded</b>"));

new Checkbox().setLabelAsHtml("<b>This is bolded too</b>");

and sanitization:

String safeHtml = Jsoup.clean(dangerousText, Whitelist.relaxed());
new Checkbox().setLabelAsHtml(safeHtml);

Furthermore there is a reason why those are marked as "unsafe-", the problem is that if there is a flaw in the framework or you miss an escaping then CSP can't differentiate injected code from the original. You should always "tag" your own safe scripts by putting them in external files or using nonce.

回复收藏 0 原文

☆獨立☆ 2025-01-27 00:07:10

因此，如果我使用此代码

scriptsrc =“ script-src'nonce-rand 0m''unsaffe-eval''self'';

它行不通。我有此错误

拒绝执行内联脚本，因为它违反了以下内容安全策略指令：“ script-src'nonce-rand land land land 0m''unnesfafe-eval''self'“”。需要“不安全限制”关键字，即Hash（'SHA256-2+3KFFW9BJFUMMZU872AJ+B2DMGLMN/HEL8BO8Y9XG ='），或者需要nonce（'nonce -...'）来启用内线执行。

回复收藏 0 原文

~没有更多了~