canmove, Confirmed users
1,537
edits
Security/CSP/Deploying: Difference between revisions
Jump to navigation
Jump to search
→javascript: URIs
(→eval()) |
|||
| Line 43: | Line 43: | ||
=== <b><tt>javascript:</tt> URIs</b> === | === <b><tt>javascript:</tt> URIs</b> === | ||
; The Problem : URIs that use the <tt>javascript</tt> scheme are another popular method to inject and run arbitrary script on a web page. Like inline script, these can be injected into html tags causing arbitrary script execution, so CSP disables <tt>javascript:</tt> URIs. | ; The Problem : URIs that use the <tt>javascript</tt> scheme are another popular method to inject and run arbitrary script on a web page. Like inline script, these can be injected into html tags causing arbitrary script execution, so CSP disables <tt>javascript:</tt> URIs, including in clickable resources (i.e., where CSP doesn't filter links to other sites). | ||
; General Solution : If <tt>javascript:</tt> URIs are used in your web site, they can often be converted to script-initiated code. Common uses of such URIs are: | ; General Solution : If <tt>javascript:</tt> URIs are used in your web site, they can often be converted to script-initiated code. Common uses of such URIs are: | ||
* ''TODO: list cases'' | * ''TODO: list cases'' | ||