Re: CSP script-src - Allow Js Events

That's a pretty broad exemption since functions cN do arbitrarily complex
and powerful things. You might be interested in CSP3's
unsafe-hashed-attributes, though:
https://w3c.github.io/webappsec-csp/#unsafe-hashed-attributes-usage It
allows whitelisted-by-hash inline event handlers.

On Fri, Jun 10, 2016, 8:18 AM Harssh Mahajan <harssh@gmail.com> wrote:

> Hi,
>
> The  script-src: 'unsafe-inline' does 2 jobs:
> 1. Allow execution of inline & on page js.
> *2. Allow Js events such as onclick, onchange, etc*
>
> Js Events can not be always binded using js as it doesn't work on some
> browsers (on mobile devices).
> Allowing only Js events would not open up more vectors for XSS if we
> restrict it to calling functions (onclick='jsFunc();') only & not
> executing inline js (onclick='prompt(..)').
>
> Maybe we could add new value for script-src:
> unsafe-js-event would only allow calling Functions using js events.
> unsafe-inline would only allow execution of js code on page.
> With domain white-listing, the scope will be limited.
>
> Regards,
> Harssh Mahajan
>