1652257 - Firefox CSP inline script Error w/jQuery on specific site

Status: RESOLVED INCOMPLETE

(Core :: DOM: Security, defect)

Description

[obscenefurr]

Attachment: err.zip (SHA1 - F9265FC180BDE04625AC0885568E6F3E1F8BC17A) Screenshots of the results and referenced cursor position.

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

Steps to reproduce:

Visited the home page of the website I've been working on, whilst having the console open, confirming new CSP hashes are working for newly added changes, which I checked off for every inline script and style.

Actual results:

Firefox is saying there is an inline script (seen in first attached image) which for one is not inline, and secondly starts in the middle of a seemingly arbitrary variable (seen in the third image).

Chrome is able to accept this script, and has no such error (seen in the second image).

I'm quite sure this is not normal behavior, and I want to make sure my site is fully compatible with Firefox.

Expected results:

The script file is not seen as inline.
The CSP error does not occur.
The script start position on the error is correct.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Daniel Veditz [:dveditz]]

Attachment: csp01.jpg

Comment 3

[Daniel Veditz [:dveditz]]

Attachment: csp02.jpg

Attaching a zip, unless it's huge or a ton of files, is a PITA. Please just attach screenshots directly.

Comment 4

[Daniel Veditz [:dveditz]]

Attachment: csp03.jpg

Comment 5

[obscenefurr]

(In reply to Daniel Veditz [:dveditz] from comment #3)

Created attachment 9163595 [details]
csp02.jpg

Attaching a zip, unless it's huge or a ton of files, is a PITA. Please just attach screenshots directly.

It would only let me upload a single file when creating the post

Comment 6

[Daniel Veditz [:dveditz]]

You can always add more attachments later.

Comment 7

[Daniel Veditz [:dveditz]]

The debugger is pointing at a call to "setAttribute". I can't tell from the minimized script what attribute it is at runtime, but if it's, say "onclick" then that statement is creating an inline script. If you're using strict-dynamic I think this is supposed to be fine, but if not then it's an error.

This is not a "parsing" error, this is a runtime error. It's impossible to tell from these screenshots whether it's correct behavior or not. Do you have a public site, or better a small testcase, that shows the problem? jQuery is jQuery, but we can't tell from these shots

1. what is your CSP
2. what is your site static HTML
3. what is your site code doing to cause this call to jQuery that gets detected.

Comment 8

[Daniel Veditz [:dveditz]]

We can reopen this if we get more to work with.

Comment 9

[obscenefurr]

(In reply to Daniel Veditz [:dveditz] from comment #7)

1. what is your CSP

Its a mess, but it's available in the site headers.
There's no fast way to check old hashes I don't need, so they just stay there.
Any time something changes I add a new hash to script-src or style-src.

2. what is your site static HTML

Static HTML is a hard question, its dynamically generated from php.

3. what is your site code doing to cause this call to jQuery that gets detected.
   Not sure about that, something internal in wordpress likely.

The site is in open alpha now because I had to bring the firewall down for SEO.
I'm still actively working on content and optimizations.

vps.help