NoScript 2.2.4 triggers a csp violation on pages that disable inline scripts using the X-Content-Security-Policy header.
It seems that CSP considers the following NoScript-provided snippet as an inline script executed in the context of the csp-enabled page and denies the execution attempt.
Code: Select all
try{
window.toStaticHTML = function toStaticHTML(s) {
var t = document.createElement("toStaticHTML");
t.setAttribute("data-source", s);
document.documentElement.appendChild(t);
var ev = document.createEvent("Events");
ev.initEvent("NoScript:toStaticHTML", true, false);
t.dispatchEvent(ev);
return t.innerHTML;
}
} catch(e){
}
In php, you can create a test page with
Code: Select all
<?php header("X-Content-Security-Policy: allow 'self'"); ?>
For completeness, here is the full CSP report:
Code: Select all
CSP debug: Constructed violation report:
{"csp-report":{"request":"GET http://localhost/spiderTest/csp.php HTTP/1.1","blocked-uri":"self","violated-directive":"inline script base restriction","source-file":"http://localhost/spiderTest/csp.php","script-sample":"try{window.toStaticHTML = function toSta..."}}
