Re:Htmx does not play well with content security policy
by elmigranto on Tuesday July 02, 2024 @07:53AM
(#40855731)
> if someone manages to inject arbitrary HTML
If they can, why wouldn’t it be inline <script>?
Re:Htmx does not play well with content security policy
by amluto on Tuesday July 02, 2024 @07:57AM
(#40855759)
Because CSP can be configured to block inline scripts.
Re:Htmx does not play well with content security policy
by jsheard on Tuesday July 02, 2024 @08:00AM
(#40855779)
The syntax to allow inline scripts is even "unsafe-inline" to emphasize that you are entering the danger zone.
Re:Htmx does not play well with content security policy
by Akronymus on Tuesday July 02, 2024 @07:54AM
(#40855737)
serving html with string concatenation is just like creating sql statements with string concat.
At least thats how I see it. Ideally you'd use something similar to prepared statements, just for html templates.
Re:Htmx does not play well with content security policy
by stouset on Tuesday July 02, 2024 @08:46AM
(#40856096)
CSP is a backstop that—when configured properly and used alongside restraint in how you script—can minimize some of the worst consequences of injection.
It doesn’t wash your hands clean of the responsibility to restrict what kinds of content users can inject into served pages.
Not really. The whole point of CSP is that, even if someone manages to inject arbitrary HTML into your page due to a bug or oversight, you can prevent injected scripts from running entirely, severely limiting what an attacker can do.
I'm surprised at the amount of comments on this post that seem to be completely clueless about CSP.