Skip to content

Instantly share code, notes, and snippets.

@lweichselbaum

lweichselbaum/FF_CSP_BUG.html

Last active June 16, 2018 11:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lweichselbaum/9c8e32c592889ffc2f103fce9d45eaea to your computer and use it in GitHub Desktop.
Save lweichselbaum/9c8e32c592889ffc2f103fce9d45eaea to your computer and use it in GitHub Desktop.
Download ZIP
Firefox CSP Bug - Dynamically created script with correct nonce gets blocked because of redirect.
Raw
FF_CSP_BUG.html
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcd1234'">
</head>
<body>
<script nonce='abcd1234'>
var s = document.createElement('script');
s.setAttribute('nonce', 'abcd1234');
s.src = 'https://goo.gl/jEH8zk'; // redirects to jquery.
document.head.appendChild(s);
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment