CODEWITHSUNDEEP
javascriptcsssecuritycontent-security-policymicrosoft-edge
StackOverflowAcc
StackOverflowAcc

Reputation: 171

Microsoft Edge not accepting hashes for Content-Security Policy

The problem

Content-Security-Policy should blacklist script and style parsing by default and allow it based on various instructions of which one is verified a hash of the expected output. The browser must fail to implement any Javascript or CSS which has not been given a matching hash in advance. Code with a matching hash should be executed as normal. Microsoft Edge is refusing all JS/CSS in-page blocks.

Demonstration original source code

<!doctype html>
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'sha256-JtUhvM7uQO2KX5IEGWxN+rhEyzzsyFelfO2gXvYEuWA='; script-src https://ajax.googleapis.com 'sha256-iZzrsbzuGxfOaTdnB/E6RQBssyXQRp7W8YtZD2Wg/Rc=';" />
<meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; style-src 'sha256-JtUhvM7uQO2KX5IEGWxN+rhEyzzsyFelfO2gXvYEuWA='; script-src https://ajax.googleapis.com 'sha256-iZzrsbzuGxfOaTdnB/E6RQBssyXQRp7W8YtZD2Wg/Rc=';" />
<style>#loading{color:transparent}#loading:after{color:green;content:"Style loaded."}</style>
</head>
<body>
<span id="loading">Hashes loading...</span>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
<script>alert("Script loaded.")</script>

CSP14304: Unknown source ‘'sha256-JtUhvM7uQO2KX5IEGWxN+rhEyzzsyFelfO2gXvYEuWA='’ for directive ‘style-src’ in - source will be ignored.

CSP14306: No sources given for directive ‘style-src’ for - this is equivalent to using ‘none’ and will prevent the downloading of all resources of this type.

CSP14304: Unknown source ‘'sha256-iZzrsbzuGxfOaTdnB/E6RQBssyXQRp7W8YtZD2Wg/Rc='’ for directive ‘script-src’ in - source will be ignored.

CSP14312: Resource violated directive ‘style-src 'sha256-JtUhvM7uQO2KX5IEGWxN+rhEyzzsyFelfO2gXvYEuWA='’ in : inline style. Resource will be blocked.

CSP14312: Resource violated directive ‘script-src LINK-REMOVED-INSUFFICIENT-REPUTATION-ON-STACKOVERFLOW-SHOULD-BE-THE-GOOGLE-API-URL 'sha256-iZzrsbzuGxfOaTdnB/E6RQBssyXQRp7W8YtZD2Wg/Rc='’ in : inline script. Resource will be blocked.

Attempted fixes

I can't think of anything else to try.

Update 24 hours later: Added X-Content-Security-Policy for completeness & JSBin URL updated, though it doesn't make a difference to this particular situation.

Upvotes: 9

Views: 6253

Answers (2)

oreoshake
oreoshake

Reputation: 4918

EDIT: this may be incorrect. See comments above.

IE 11 does not support Content-Security-Policy (only X-Content-Security-Policy), this fails open. IE 12 supports CSP, but does not grok nonces/hashes, it fails closed... unless you also supply 'unsafe-inline' in a Content-Security-Policy header.

CSP level 2 says "if a hash or nonce is supplied, ignore 'unsafe-inline'." this is for backwards compatibility since older browsers will grok the 'unsafe-inline' but not the nonces/hashes. See http://www.w3.org/TR/CSP2/#directive-script-src

Upvotes: 9

Clauz
Clauz

Reputation: 31

http://caniuse.com/#feat=contentsecuritypolicy

http://caniuse.com/#feat=contentsecuritypolicy2

IE Edge does not support Content Security Policy Level 2, and hash-source belongs to level 2.

Upvotes: 3

Related Questions