Warm tip: This article is reproduced from serverfault.com, please click
content-security-policy firefox firefox-addon

Firefox gives an error with a CSP policy that shouldn't happen

发布于 2020-11-27 18:55:44

A firefox addon with the following csp in the sidebar html document: <meta http-equiv="Content-Security-Policy" content="style-src *;">

Gives this error with a <style></style> embedded in the same html document of that policy

Error:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).

I get the same error with "style-src 'self';" or "default-src *;" or etc, it only works when i dont use default-src or style-src

This shouldn't happen so please tell me if i missed something

Thanks for your time

Questioner
user10156126
Viewed
0
分享
granty 2020-11-28 13:31:44

'self' and * allow external sources only (ie <link href='https://example.com' rel='stylesheet'>).
To allow inline styles requires 'unsafe-inline' or 'nonce-value' token. For example:

<meta http-equiv="Content-Security-Policy" content="style-src 'nonce-abcFe45';">

and in the HTML:

<style nonce="abcFe45">
...
</style>

Or <meta http-equiv="Content-Security-Policy" content="style-src 'unsafe-inline';"> will allow any inline <style></style> blocks and <tag style='color:red'> too.

热门帖子

1
学英语的朋友们可以来看看 https://langplayground.top/
2
华中科大的计算机技术的在职硕士，职场认可度如何？
3
十兆宽带 100 块钱一个月我是活在 80 年代吗？
4
关于高质量 屏幕共享的问题
5
我是真的受不了打小报告的三八了！
6
怎么管理自己的文件体系
7
[开发者自荐] AirBattery: 在 Mac 端获取所有设备的电量并显示在 Dock 或状态栏上
8
南京移动 IPV6 被停
9
WireGuard 跨国组网失败后,一个新工具的诞生
10
你的 IDEA(2024.1) 在 macOS 上崩吗？

热门github

1
A multi-platform library for OpenGL, OpenGL ES, Vulkan, window and input
2
Dev tool that writes scalable apps from scratch while the developer oversees the implementation
3
shadcn/ui, but for Svelte. ✨
4
The Python Risk Identification Tool for generative AI (PyRIT) is an open access automation framework to empower security professionals and machine learning engineers to proactively find risks in their generative AI systems.
5
Performance-portable, length-agnostic SIMD with runtime dispatch
6
ZK Credo
7
OpenCodeInterpreter: Integrating Code Generation with Execution and Refinement
8
Joplin - the secure note taking and to-do app with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.
9
Mamba is a new state space model architecture showing promising performance on information-dense data such as language modeling, where previous subquadratic models fall short of Transformers. It is based on the line of progress on structured state space models, with an efficient hardware-aware design and implementation in the spirit of FlashAttention.
10
This repository contains System Design resources which are useful while preparing for interviews and learning Distributed Systems
11
Curso para aprender el lenguaje de programación Python desde cero y para principiantes. 75 clases, 37 horas en vídeo, código, proyectos y grupo de chat. Fundamentos, frontend, backend, testing, IA...
12
🎓 Path to a free self-taught education in Computer Science!
13
1️⃣🐝🏎️ The One Billion Row Challenge -- A fun exploration of how quickly 1B rows from a text file can be aggregated with Java
14
A collective list of free APIs
15
📚 Freely available programming books